Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in adminbypasser (PyPI)

Malicious code was published in the adminbypasser package on PyPI. The package silently downloads and executes remote code, establishing persistence via autostart mechanisms. The remote domain used by the malware no longer exists at the time of analysis.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Unknown; package available on PyPI with silent malicious behavior
Ecosystems
PyPI
Attack vectors
Compromised package
Affected entities
  • adminbypasserPyPI package

The adminbypasser package published on PyPI contained malicious code designed to download and execute remote scripts without user knowledge. The malware established persistence by adding itself to system autostart mechanisms, ensuring execution across system reboots.\n\nThe attack was identified and attributed to a campaign designated "2026-02-old-adminbypasser" by security researchers. Analysis revealed the package exhibited clear malicious intent consistent with infostealers and persistence-focused malware.\n\nAt the time of analysis, the remote domain used to deliver the malicious payload was no longer accessible. The incident was credited to the OpenSSF's malicious-packages project, which tracks confirmed malicious packages across package ecosystems.\n\nThe package has been identified and removed from circulation, though the exact versions and timeline of availability require verification through PyPI records.

Remediation

  • Identify and remove all installations of the adminbypasser package from affected systems
  • Scan systems for persistence mechanisms (autostart entries, scheduled tasks) added by the malware
  • Review system logs for evidence of remote code execution or suspicious network connections
  • Monitor for indicators of compromise from the malware campaign
  • Check PyPI for any related or similarly-named packages that may contain similar malicious code

Sources

  1. GitHub Advisory GHSA-vc77-379x-c38j · GitHub Advisory Database

Cite this entry

"Malicious code in adminbypasser (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-adminbypasser-pypi-1ytbg3

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in afrit-name (PyPI)

    Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.

    PyPICompromised package
  2. resolvedcritical

    Malicious code in adv2099m7 (PyPI)

    Malicious code was discovered in the adv2099m7 package on PyPI. The package was identified and cataloged by the OpenSSF malicious packages project.

    PyPICompromised package
  3. resolvedcritical

    Malicious code in adrandom (PyPI)

    The adrandom package on PyPI contained malicious code that executed spyware and information-stealing malware. It was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.

    EsquelesquadPyPICompromised package
  4. resolvedcritical

    Malicious code in ziphash (PyPI)

    The ziphash package on PyPI contained malicious code that downloads and executes multi-stage malware during archive-support class initialization. The malware exhibits obfuscation and remote code execution capabilities, classified as part of the 2025-11-uzip campaign.

    2025 11 UzipPyPICompromised package