Malicious code in agent-user-generate (PyPI)
The PyPI package agent-user-generate contained malicious code that exfiltrated user data, downloaded and executed next-stage payloads, and installed infostealer malware (Lumma and a custom variant). The package cloned a legitimate project and hid malicious functionality within library usage.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on installation count and user data exposure scope
- Ecosystems
- Attack vectors
- Affected entities
- agent-user-generateMalicious package on PyPI
The agent-user-generate package published on PyPI contained obfuscated malicious code designed to steal user information and install infostealer malware. The malicious payload was hidden within the library's normal code path (around line 110) and executed when the library was used.
The attack chain included data exfiltration, downloading and executing next-stage code, stealing TXT files, and installing known infostealer malware including Lumma and a custom variant. The package was part of a campaign (2024-10-fake-usreagent) that cloned a legitimate package to deceive users.
The malicious behavior included clipboard stealing, file exfiltration, and code obfuscation to evade detection. The incident was identified and documented by the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- agent-user-generate
Remediation
- Immediately uninstall agent-user-generate from all systems
- Scan affected systems for Lumma and custom infostealer malware
- Review and rotate credentials, SSH keys, and sensitive data that may have been exfiltrated
- Check clipboard history and file access logs for unauthorized data access
- Monitor for suspicious network connections and data exfiltration
- Verify the legitimacy of any package before installation; use official documentation and verify package maintainers
Sources
- GitHub Advisory GHSA-28w5-cpf5-v7x3 · GitHub Advisory Database
Cite this entry
"Malicious code in agent-user-generate (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-agent-user-generate-pypi-y59mmj
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in afrit-name (PyPI)
Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adv2099m7 (PyPI)
Malicious code was discovered in the adv2099m7 package on PyPI. The package was identified and cataloged by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adrandom (PyPI)
The adrandom package on PyPI contained malicious code that executed spyware and information-stealing malware. It was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.
EsquelesquadPyPICompromised package - resolvedcritical
Malicious code in ziphash (PyPI)
The ziphash package on PyPI contained malicious code that downloads and executes multi-stage malware during archive-support class initialization. The malware exhibits obfuscation and remote code execution capabilities, classified as part of the 2025-11-uzip campaign.
2025 11 UzipPyPICompromised package