Malicious code in agent-user-generate (PyPI)
The PyPI package agent-user-generate contained malicious code that exfiltrated user data, downloaded and executed next-stage payloads, and installed infostealer malware (Lumma and a custom variant). The package cloned a legitimate project and hid malicious functionality within library usage.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on installation count and user data exposure scope
- Ecosystems
- Attack vectors
- Affected entities
- agent-user-generateMalicious package on PyPI
The agent-user-generate package published on PyPI contained obfuscated malicious code designed to steal user information and install infostealer malware. The malicious payload was hidden within the library's normal code path (around line 110) and executed when the library was used.
The attack chain included data exfiltration, downloading and executing next-stage code, stealing TXT files, and installing known infostealer malware including Lumma and a custom variant. The package was part of a campaign (2024-10-fake-usreagent) that cloned a legitimate package to deceive users.
The malicious behavior included clipboard stealing, file exfiltration, and code obfuscation to evade detection. The incident was identified and documented by the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- agent-user-generate
Remediation
- Immediately uninstall agent-user-generate from all systems
- Scan affected systems for Lumma and custom infostealer malware
- Review and rotate credentials, SSH keys, and sensitive data that may have been exfiltrated
- Check clipboard history and file access logs for unauthorized data access
- Monitor for suspicious network connections and data exfiltration
- Verify the legitimacy of any package before installation; use official documentation and verify package maintainers
Sources
- GitHub Advisory GHSA-28w5-cpf5-v7x3 · GitHub Advisory Database
Cite this entry
"Malicious code in agent-user-generate (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-agent-user-generate-pypi-y59mmj
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedhigh
Malicious code in riakcs (PyPI)
The riakcs package on PyPI contained malicious code that exfiltrates basic host information (IP address, username) during installation. The package overrides the install command in setup.py to execute the malicious payload when installed.
PyPICompromised package - containedcritical
Malicious code in fastapii (PyPI)
The fastapii package on PyPI is a typosquatting attack imitating the popular FastAPI library. During installation, it executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
2026 08 FlasqPyPITyposquattingCompromised package - containedcritical
Malicious code in idnna (PyPI)
A malicious package named idnna was published to PyPI, imitating a legitimate library. During installation, the package executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
PyPITyposquattingCompromised package - containedcritical
Malicious code in pydanticc (PyPI)
The PyPI package pydanticc is a typosquatting attack imitating the popular pydantic library. During installation, it executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
2026 08 FlasqPyPITyposquattingCompromised package