Malicious code in decapod-common (PyPI)
Malicious code was published in the decapod-common package on PyPI. The package exfiltrates basic host information (IP address, username) upon installation or import, with the malicious behavior executed via a setup.py install command override.
- Disclosed
- Last updated
- Blast radius
- All users who installed the malicious decapod-common package from PyPI
- Ecosystems
- Attack vectors
- Affected entities
- decapod-commonPyPI package containing malicious code
The decapod-common package published on PyPI contained malicious code designed to exfiltrate basic system information from affected hosts. The malicious payload was triggered during package installation or module import.\n\nThe attack vector involved overriding the install command in setup.py to execute the exfiltration code during the installation process. The package had no legitimate functionality beyond this malicious behavior.\n\nThe incident was identified and attributed to the OpenSSF's malicious-packages repository (MAL-2026-13386). The malicious code collected limited host data such as IP addresses and usernames, representing a reconnaissance-level threat.\n\nUsers who installed or imported this package should assume their basic system information was exfiltrated and take appropriate remediation steps.
Indicators of compromise
- Packages
- decapod-common
Remediation
- Immediately uninstall the decapod-common package from all affected systems
- Audit system logs for any suspicious activity or data exfiltration following the installation date
- Assume basic host information (IP address, username) has been compromised and monitor for related security incidents
- Review PyPI package installation logs to identify all systems that may have installed this package
- Consider rotating credentials and reviewing access logs for affected systems
- Monitor for any follow-up attacks or lateral movement attempts
Sources
- GitHub Advisory GHSA-vxw2-2m2p-c6rj · GitHub Advisory Database
Cite this entry
"Malicious code in decapod-common (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 6, 2026; last updated August 6, 2026. https://supplychainattack.org/incident/malicious-code-in-decapod-common-pypi-t6s28m
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedhigh
Malicious code in morpho-sdk (PyPI)
The morpho-sdk package on PyPI contained malicious code that exfiltrates basic host information (IP address, username) during installation. The package overrides the install command in setup.py to execute the malicious payload when installed.
PyPICompromised package - resolvedcritical
Malicious code in dlmm-sdk (PyPI)
dlmm-sdk, a PyPI package, was compromised with malicious code that exfiltrates environment variables, credential files, and cryptocurrency wallet directory listings upon import. The malicious campaign (2026-08-dlmm) was identified and attributed to OpenSSF's malicious-packages repository.
PyPICompromised package - resolvedcritical
Malicious code in joule-btp-extension (PyPI)
Malicious code was published in joule-btp-extension on PyPI (version 0.1.6). The package contained code to exfiltrate system information, establish reverse shells, and communicate with domains associated with malicious activity. The incident appears to have been an internal test accidentally uploaded to a public repository.
PyPICompromised package - resolvedhigh
Malicious code in euler-sdk (PyPI)
The euler-sdk package on PyPI contained malicious code that exfiltrates basic host information (IP address, username) during installation. The package overrides the install command in setup.py to execute the malicious payload when installed.
PyPICompromised package