Malicious code in atlas-internal (PyPI)
Multiple malicious versions of atlas-internal were published to PyPI containing code that exfiltrates host information (hostname, working directory, username) during installation. The package overrides the egg_info command in setup.py to execute automatically on pip install without user interaction, sending collected data to attacker-controlled out-of-band callback servers.
- Disclosed
- Last updated
- Blast radius
- Any user installing atlas-internal from PyPI
- Ecosystems
- Attack vectors
- Affected entities
- atlas-internalPyPI package with malicious setup.py
The atlas-internal package on PyPI contained malicious code designed to exfiltrate system information during installation. At least two malicious variants were identified:
The first variant (amazon-inspector source) overrides the egg_info command in setup.py to execute automatically during pip install. The overridden command collects the installer's hostname, current working directory, and OS username, URL-encodes them, and sends them via HTTP GET request to a hardcoded Interactsh out-of-band callback subdomain (fpvbsifkklbmklusmxby2405wa7x7x5bf.oast.fun). This reconnaissance beacon fires on default install without requiring user interaction.
The second variant (kam193 source) similarly exfiltrates basic host information upon package installation or module import, with no legitimate functionality.
Both variants represent dependency-confusion reconnaissance attacks, consistent with pentest tooling abuse. The malicious packages were identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- atlas-internal
- Domains
- fpvbsifkklbmklusmxby2405wa7x7x5bf.oast.fun
- Hashes
- cdd4a17504623add1ff4f374ea9c2283d1eb5a863265e012592142b169cd9d90
- e41b6a5ae4af745c6bc5b2514fa7202d95242ef71a60a57f130524ccfddc99da
Remediation
- Remove atlas-internal from all systems where it was installed
- Audit systems that installed atlas-internal for signs of compromise or data exfiltration
- Review network logs for HTTP requests to fpvbsifkklbmklusmxby2405wa7x7x5bf.oast.fun or similar Interactsh domains
- Use pip to uninstall the package: pip uninstall atlas-internal
- Verify PyPI package integrity and monitor for similar typosquatting or dependency-confusion attempts
- Consider using package pinning and verification tools to prevent installation of unexpected packages
Sources
- GitHub Advisory GHSA-xjf2-85x6-fwr4 · GitHub Advisory Database
Cite this entry
"Malicious code in atlas-internal (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-atlas-internal-pypi-vzqkv1
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedhigh
Malicious code in kb-ai (PyPI)
The kb-ai package on PyPI contained malicious code designed to demonstrate a dependency confusion attack. The package exfiltrated basic system data (IP address, username) and executed arbitrary code during installation via setup.py override.
PyPICompromised packageDependency confusion - containedcritical
Malicious code in plp-contract (PyPI)
The PyPI package plp-contract intentionally depends on a malicious package (neutrl-core) designed to exfiltrate sensitive credentials including environment variables, SSH keys, and dotenv files. The malicious code is disguised as telemetry and activates via remote command delivery from an attacker-controlled endpoint.
2026 08 Neutrl CorePyPICompromised packageDependency confusion - resolvedcritical
Malicious code in neutrl-contracts (PyPI)
The PyPI package neutrl-contracts intentionally depends on a malicious package (neutrl-core) that exfiltrates sensitive credentials including environment variables, SSH keys, and dotenv files. The malicious code is disguised as telemetry and activated remotely by an attacker-controlled endpoint.
PyPICompromised packageDependency confusion - resolvedhigh
Malicious code in cubesat-upstream-driver (PyPI)
Malicious code was published to PyPI in the cubesat-upstream-driver package, capable of collecting environment variables. The package was detected as part of a CTF-like exercise or pentest campaign and does not appear to exfiltrate data autonomously.
PyPICompromised packageDependency confusion