Malicious code in ai-labs-snippets-sdk (PyPI)
The ai-labs-snippets-sdk package on PyPI contained malicious code that exfiltrates system information (IP address, username, .gitconfig) to a remote target. The malicious payload was embedded as pickle-serialized code within a file disguised as an AI model, executed during package import.
- Disclosed
- Last updated
- Blast radius
- All users who installed affected versions of ai-labs-snippets-sdk from PyPI
- Ecosystems
- Attack vectors
- Threat actor
- Affected entities
- ai-labs-snippets-sdkPyPI package containing malicious code
The ai-labs-snippets-sdk package distributed via PyPI contained malicious code designed to exfiltrate sensitive system information. Upon import, the package loads a file masquerading as an AI model that contains pickle-serialized malicious code.\n\nThe payload collects basic system data including IP address, username, and the contents of the user's .gitconfig file, then transmits this information to a remote attacker-controlled target. This represents a data exfiltration attack with limited but real impact on affected systems.\n\nThe malicious package was identified and attributed to campaign 2025-05-ai-labs-snippets-sdk. Multiple versions of the package were compromised. The incident was documented by the OpenSSF malicious-packages project (MAL-2025-5094).
Indicators of compromise
- Packages
- ai-labs-snippets-sdk
Remediation
- Immediately uninstall ai-labs-snippets-sdk from all systems
- Audit systems that imported the package for unauthorized access or data exfiltration
- Review .gitconfig files and git credentials for potential compromise
- Check network logs for suspicious outbound connections from the time of package installation
- Rotate any credentials or tokens that may have been exposed via .gitconfig
- Use a package manager with security scanning to prevent installation of malicious packages
Sources
- GitHub Advisory GHSA-3958-5f85-fq5w · GitHub Advisory Database
Cite this entry
"Malicious code in ai-labs-snippets-sdk (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-ai-labs-snippets-sdk-pypi-1ofwuf
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in fastapii (PyPI)
The fastapii package on PyPI is a typosquatting attack imitating the popular FastAPI library. During installation, it executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
2026 08 FlasqPyPITyposquattingCompromised package - containedcritical
Malicious code in idnna (PyPI)
A malicious package named idnna was published to PyPI, imitating a legitimate library. During installation, the package executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
PyPITyposquattingCompromised package - containedcritical
Malicious code in pydanticc (PyPI)
The PyPI package pydanticc is a typosquatting attack imitating the popular pydantic library. During installation, it executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
2026 08 FlasqPyPITyposquattingCompromised package - containedcritical
Malicious code in flasq (PyPI)
A malicious package named flasq was published on PyPI, imitating a popular library. During installation, it executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
PyPITyposquattingCompromised package