Malicious code in bigtime (PyPI)
The bigtime package on PyPI contained malicious code designed to exfiltrate data by overwriting the built-in "open" function and monitoring file writes. The package also attached watchers to files in the user's home directory to capture sensitive information.
- Disclosed
- Last updated
- Blast radius
- Any user who installed the malicious bigtime package from PyPI
- Ecosystems
- Attack vectors
- Threat actor
- Affected entities
- bigtimePyPI package containing malicious code
The bigtime package published on PyPI contained hidden malicious code with clear intent to steal user data. The malware overwrites Python's built-in "open" function to intercept and exfiltrate every write operation to opened files.\n\nBeyond file write interception, the malicious code also attached watchers to other files in the user's home directory, enabling broad surveillance of file system activity and potential exfiltration of sensitive data stored locally.\n\nThe malicious package was identified and attributed to the 2026-08-bigtime campaign by the OpenSSF's malicious-packages project. The incident was disclosed on 2026-08-11 via GitHub Security Advisory GHSA-28hg-x9rg-9j9w."
Indicators of compromise
- Packages
- bigtime
Remediation
- Immediately uninstall the bigtime package from all affected systems using 'pip uninstall bigtime'
- Audit systems that installed bigtime for signs of data exfiltration or unauthorized file access
- Review file system logs and network traffic for suspicious activity during the period the malicious package was installed
- Change passwords and credentials for any accounts that may have been compromised
- Monitor for any data breaches or unauthorized access to sensitive files that were present in home directories
Sources
- GitHub Advisory GHSA-28hg-x9rg-9j9w · GitHub Advisory Database
Cite this entry
"Malicious code in bigtime (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 11, 2026; last updated August 11, 2026. https://supplychainattack.org/incident/malicious-code-in-bigtime-pypi-1ijgux
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in socks5901 (PyPI)
The PyPI package socks5901 contained malicious code that exfiltrates files from /sdcard/ during import and communicates via Telegram bot. The package was identified and cataloged by the OpenSSF malicious-packages project.
PyPICompromised package - resolvedhigh
Malicious code in kb-ai (PyPI)
The kb-ai package on PyPI contained malicious code designed to demonstrate a dependency confusion attack. The package exfiltrated basic system data (IP address, username) and executed arbitrary code during installation via setup.py override.
PyPICompromised packageDependency confusion - resolvedcritical
Malicious code in @years19/n8n-nodes-utils-helper-b (npm)
The npm package @years19/n8n-nodes-utils-helper-b contained malicious code disguised as an n8n workflow utility. The postinstall hook executed reconnaissance, downloaded and extracted a Python tarball with TLS verification disabled, and exfiltrated system information to an attacker-controlled domain.
npmPyPICompromised package - containedcritical
Malicious code in @years19/n8n-nodes-utils-helper-d (npm)
The npm package @years19/n8n-nodes-utils-helper-d contained malicious code that downloads and executes a Python DDoS/offensive-tooling dropper on installation. The package impersonates a legitimate n8n community node but performs unauthorized system reconnaissance and beacons host identity to an attacker-controlled endpoint.
npmPyPICompromised packageTyposquatting