Malicious code in dev-helper-bg (PyPI)
The PyPI package dev-helper-bg contained malicious code that executed arbitrary commands on import. The package decrypted and executed remotely-controlled code fetched from an external endpoint, and spawned a Telegram bot for command and control.
- Disclosed
- Last updated
- Blast radius
- Any Python environment that imported dev-helper-bg; arbitrary code execution on import
- Ecosystems
- Attack vectors
- Threat actor
- Affected entities
- dev-helper-bgPyPI package with malicious code
The dev-helper-bg package on PyPI contained embedded encrypted code that was decrypted and executed at module import time. On import dev_helper, the __init__.py file calls start_decryptor() at the top level, spawning a daemon thread that fetches an AES-GCM decryption key from a hardcoded Vercel endpoint (https://key-2qfm.vercel.app/api/key), decrypts a 16897-byte blob (dev_helper/encrypted.bin), and passes the plaintext to exec().
The encrypted-blob-plus-remote-key pattern allowed the attacker to rotate the executed payload without republishing the package, enabling persistent arbitrary code execution on any system that imported the module. Additionally, a bot.py file auto-started a Telegram bot with a hardcoded token in a daemon thread, providing an out-of-band command-and-control channel.
The recovered code was designed to exfiltrate local files, indicating clear malicious intent consistent with infostealer campaigns. The attack was attributed to campaign 2026-07-make-helper.
Indicators of compromise
- Packages
- dev-helper-bg
- Domains
- key-2qfm.vercel.app
Remediation
- Immediately uninstall dev-helper-bg from all Python environments
- Audit all systems that imported dev-helper-bg for unauthorized access, file exfiltration, and persistence mechanisms
- Revoke any credentials or sensitive data that may have been exposed
- Monitor for outbound connections to the Vercel endpoint and Telegram infrastructure
- Review package dependencies to ensure no other malicious packages were installed alongside dev-helper-bg
Sources
- GitHub Advisory GHSA-pcf6-hwj2-m3vw · GitHub Advisory Database
Cite this entry
"Malicious code in dev-helper-bg (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-dev-helper-bg-pypi-1ozx5j
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in govapkg (PyPI)
govapkg, a malicious PyPI package, downloads and executes a hidden binary on first use, establishing persistence via a systemd desktop autostart entry. The package obfuscates its malicious behavior through base64-encoded URLs and downloads from unverified external sources.
PyPICompromised packageMalicious commit - containedcritical
Malicious code in karpatkit (PyPI)
The karpatkit package on PyPI contained malicious code that exfiltrated sensitive credentials and secrets on import. The package spawned a daemon thread collecting environment variables, cloud credentials, SSH keys, Kubernetes tokens, cryptocurrency wallets, and shell histories, then transmitted them via HTTP to hardcoded IP addresses.
PyPICompromised packageMalicious commit - containedcritical
Malicious code in karpatkey (PyPI)
The karpatkey package on PyPI contained malicious code that exfiltrated sensitive credentials and data from infected systems. Upon import, the package spawned a background daemon thread that collected SSH keys, AWS/GCP credentials, kubeconfig, cryptocurrency wallets, and other secrets, then transmitted them via HTTP to hardcoded IP addresses.
PyPICompromised packageMalicious commit - resolvedhigh
Malicious code in advdef01 (PyPI)
The PyPI package advdef01 contained malicious code designed to exfiltrate system information (IP address, username) during installation. The package used a setup.py override to execute the malicious payload when installed.
PyPICompromised packageMalicious commit