Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in admask (PyPI)

The admask package on PyPI contained malicious code that executed spyware and information-stealing malware. It was part of a coordinated campaign by the EsqueleSquad group that published nearly 6000 malicious packages across PyPI and NPM.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Potentially thousands of installations; part of a coordinated campaign of ~6000 malicious packages across PyPI and NPM.
Ecosystems
PyPI
Attack vectors
Compromised package
Threat actor
Esquelesquad
Affected entities
  • admaskPyPI package containing malicious code

The admask package published on PyPI contained embedded malicious code designed to execute spyware and information-stealing malware on affected systems. This incident was part of a large-scale coordinated campaign by the EsqueleSquad group.

The malicious package was identified and documented by the OpenSSF's malicious-packages repository (MAL-2023-2489). The broader campaign involved the publication of nearly 6000 malicious packages across both PyPI and NPM ecosystems, representing a significant supply chain attack affecting multiple programming language communities.

The incident has been cataloged and tracked by security researchers, with detailed information available through the OpenSSF's public malicious packages database.

Indicators of compromise

Packages
  • admask

Remediation

  • Identify and remove the admask package from all environments where it was installed
  • Audit systems that may have executed the malicious package for signs of compromise, including unauthorized access, data exfiltration, or persistence mechanisms
  • Review the OpenSSF malicious-packages repository for the complete list of ~6000 affected packages and remove any others that may have been installed
  • Implement package verification and scanning in dependency management workflows to detect malicious packages before installation
  • Monitor for indicators of compromise related to spyware and information-stealing malware on affected systems

Sources

  1. GitHub Advisory GHSA-8rmh-qf26-4r5v · GitHub Advisory Database

Cite this entry

"Malicious code in admask (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-admask-pypi-yi1e1u

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in adstr (PyPI)

    The adstr package on PyPI contained malicious code as part of a campaign by EsqueleSquad group that published nearly 6000 malicious packages across PyPI and NPM. The malicious code executed spyware and information-stealing malware.

    EsquelesquadPyPICompromised package
  2. resolvedcritical

    Malicious code in afrit-name (PyPI)

    Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.

    PyPICompromised package
  3. resolvedcritical

    Malicious code in adv2099m7 (PyPI)

    Malicious code was discovered in the adv2099m7 package on PyPI. The package was identified and cataloged by the OpenSSF malicious packages project.

    PyPICompromised package
  4. resolvedcritical

    Malicious code in adrandom (PyPI)

    The adrandom package on PyPI contained malicious code that executed spyware and information-stealing malware. It was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.

    EsquelesquadPyPICompromised package