Malicious code in adpull (PyPI)
The adpull package on PyPI contained malicious code as part of a campaign by EsqueleSquad group that published nearly 6000 malicious PyPI and NPM packages. The malicious code executed spyware and information-stealing malware.
- Disclosed
- Last updated
- Blast radius
- Unknown; part of large-scale malicious package campaign
- Ecosystems
- Attack vectors
- Threat actor
- Affected entities
- adpullPyPI package containing malicious code
The adpull package on PyPI was identified as containing malicious code. This package was part of a large-scale campaign by the EsqueleSquad group, which published nearly 6000 malicious packages across PyPI and NPM repositories.\n\nThe malicious code in these packages was designed to execute spyware and information-stealing malware on affected systems. The adpull package was documented in the OpenSSF malicious-packages repository (MAL-2023-2498) and identified via Checkmarx analysis.\n\nThis incident represents a significant supply chain attack affecting the Python ecosystem through a compromised package distribution channel.
Indicators of compromise
- Packages
- adpull
Remediation
- Remove adpull from all environments and dependencies
- Audit systems that may have installed adpull for signs of compromise
- Review and revoke any credentials or sensitive data that may have been exposed
- Monitor for indicators of spyware or information-stealing malware activity
- Check the OpenSSF malicious-packages repository for the complete list of affected packages in this campaign
Sources
- GitHub Advisory GHSA-wggw-pf6v-88xf · GitHub Advisory Database
Cite this entry
"Malicious code in adpull (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-adpull-pypi-2snkpr
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in adstr (PyPI)
The adstr package on PyPI contained malicious code as part of a campaign by EsqueleSquad group that published nearly 6000 malicious packages across PyPI and NPM. The malicious code executed spyware and information-stealing malware.
EsquelesquadPyPICompromised package - resolvedcritical
Malicious code in afrit-name (PyPI)
Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adv2099m7 (PyPI)
Malicious code was discovered in the adv2099m7 package on PyPI. The package was identified and cataloged by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adrandom (PyPI)
The adrandom package on PyPI contained malicious code that executed spyware and information-stealing malware. It was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.
EsquelesquadPyPICompromised package