Malicious code in fastapii (PyPI)
The fastapii package on PyPI is a typosquatting attack imitating the popular FastAPI library. During installation, it executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on installation count of malicious fastapii package
- Ecosystems
- Attack vectors
- Threat actor
- Affected entities
- fastapiiTyposquatting package imitating FastAPI
The malicious package fastapii on PyPI is a typosquatting attack designed to deceive users into installing it instead of the legitimate FastAPI library. The package was identified as part of the 2026-08-flasq campaign by the OpenSSF malicious-packages project.\n\nDuring installation, the package overrides the setup.py install command to execute obfuscated code. This code downloads a remote malicious executable and executes it on the victim's system. The malware is designed to exfiltrate cryptocurrency wallet data and likely other sensitive information from the compromised system.\n\nThe attack leverages name confusion and automated installation processes to achieve code execution with user privileges. Users who installed this package should immediately revoke cryptocurrency wallet credentials and assume broader system compromise.
Indicators of compromise
- Packages
- fastapii
Remediation
- Immediately uninstall the fastapii package: pip uninstall fastapii
- Revoke all cryptocurrency wallet credentials and move assets to new wallets
- Assume system compromise and perform full security audit
- Check pip install history for fastapii installation
- Use legitimate FastAPI package instead: pip install fastapi
- Monitor systems for signs of data exfiltration or unauthorized access
- Report installation to security team and consider credential rotation for all accounts on affected systems
Sources
- GitHub Advisory GHSA-623m-8qff-qjw8 · GitHub Advisory Database
Cite this entry
"Malicious code in fastapii (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-fastapii-pypi-1j0pjo
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @years19/n8n-nodes-utils-helper-d (npm)
The npm package @years19/n8n-nodes-utils-helper-d contained malicious code that downloads and executes a Python DDoS/offensive-tooling dropper on installation. The package impersonates a legitimate n8n community node but performs unauthorized system reconnaissance and beacons host identity to an attacker-controlled endpoint.
npmPyPICompromised packageTyposquatting - containedcritical
Malicious code in flasq (PyPI)
A malicious package named flasq was published on PyPI, imitating a popular library. During installation, it executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
PyPITyposquattingCompromised package - containedcritical
Malicious code in idnna (PyPI)
A malicious package named idnna was published to PyPI, imitating a legitimate library. During installation, the package executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
PyPITyposquattingCompromised package - containedcritical
Malicious code in fast-hashes (PyPI)
A malicious package named fast-hashes was published to PyPI, using typosquatting to imitate a legitimate library. During installation, obfuscated code downloads and executes a remote malicious executable that exfiltrates cryptocurrency wallet data and potentially other sensitive information.
2026 08 Flasq CampaignPyPITyposquattingCompromised package