Malicious code in adinfo (PyPI)
The adinfo package on PyPI contained malicious code as part of a campaign by EsqueleSquad group that published nearly 6000 malicious packages across PyPI and NPM. The package executed spyware and information-stealing malware.
- Disclosed
- Last updated
- Blast radius
- Potentially thousands of installations; part of a large-scale malicious package campaign affecting both PyPI and NPM ecosystems.
- Ecosystems
- Attack vectors
- Affected entities
- adinfoPyPI package containing malicious code
The adinfo package published on PyPI was identified as containing malicious code. This package was part of a large-scale coordinated campaign by the EsqueleSquad group.\n\nEsqueleSquad published nearly 6000 malicious packages across both PyPI and NPM ecosystems. These packages were designed to execute spyware and information-stealing malware on systems where they were installed.\n\nThe malicious package was identified and documented by the OpenSSF (Open Source Security Foundation) in their malicious-packages repository, with the identifier MAL-2023-2487. The incident was discovered and reported through Checkmarx security research.
Indicators of compromise
- Packages
- adinfo
Remediation
- Immediately uninstall the adinfo package from all systems
- Audit systems that installed adinfo for signs of compromise, including unauthorized network connections and data exfiltration
- Review package dependencies to ensure no other malicious packages from the EsqueleSquad campaign were installed
- Implement package verification and scanning in your dependency management workflow
- Monitor PyPI and NPM for similar malicious package campaigns
Sources
- GitHub Advisory GHSA-267x-5m72-7874 · GitHub Advisory Database
Cite this entry
"Malicious code in adinfo (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-adinfo-pypi-50afef
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in adpip (PyPI)
The adpip package on PyPI was identified as malicious code, part of a campaign by EsqueleSquad that published nearly 6000 malicious packages across PyPI and NPM. The package executes spyware and information-stealing malware.
PyPICompromised package - resolvedcritical
Malicious code in adstr (PyPI)
The adstr package on PyPI contained malicious code as part of a campaign by EsqueleSquad group that published nearly 6000 malicious packages across PyPI and NPM. The malicious code executed spyware and information-stealing malware.
PyPICompromised package - resolvedcritical
Malicious code in adtool (PyPI)
The adtool package on PyPI contained malicious code that executed spyware and information-stealing malware. This package was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.
PyPICompromised package - resolvedcritical
Malicious code in afrit-name (PyPI)
Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.
PyPICompromised package