Malicious code in flasq (PyPI)
A malicious package named flasq was published on PyPI, imitating a popular library. During installation, it executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
- Disclosed
- Last updated
- Blast radius
- All users who installed the malicious flasq package from PyPI
- Ecosystems
- Attack vectors
- Affected entities
- flasqMalicious package on PyPI imitating a popular library
The flasq package on PyPI was identified as malicious by the OpenSSF malicious-packages project. The package uses typosquatting to imitate a legitimate library name and employs obfuscated code to evade detection.\n\nDuring installation, the malicious package overrides the install command in setup.py to execute obfuscated code. This code downloads a remote executable and executes it on the victim's system. The attack is designed to exfiltrate sensitive data, with confirmed targeting of cryptocurrency wallet data and likely additional personal information.\n\nThe campaign was identified and cataloged as MAL-2026-13487 by the OpenSSF malicious-packages repository. The malicious intent is clear, with the package functioning as an infostealer.
Indicators of compromise
- Packages
- flasq
Remediation
- Immediately uninstall the flasq package if installed: pip uninstall flasq
- Audit systems where flasq was installed for signs of compromise, particularly cryptocurrency wallets and sensitive credentials
- Change passwords and security credentials on affected systems
- Monitor cryptocurrency wallets for unauthorized transactions
- Review system logs for suspicious process execution and network connections
- Consider the system compromised and perform a full security audit
- Use only the legitimate Flask library or verify the correct package name before installation
Sources
- GitHub Advisory GHSA-6gvf-7rvp-929m · GitHub Advisory Database
Cite this entry
"Malicious code in flasq (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-flasq-pypi-kzdyio
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @years19/n8n-nodes-utils-helper-d (npm)
The npm package @years19/n8n-nodes-utils-helper-d contained malicious code that downloads and executes a Python DDoS/offensive-tooling dropper on installation. The package impersonates a legitimate n8n community node but performs unauthorized system reconnaissance and beacons host identity to an attacker-controlled endpoint.
npmPyPICompromised packageTyposquatting - containedcritical
Malicious code in fastapii (PyPI)
The fastapii package on PyPI is a typosquatting attack imitating the popular FastAPI library. During installation, it executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
2026 08 FlasqPyPITyposquattingCompromised package - containedcritical
Malicious code in idnna (PyPI)
A malicious package named idnna was published to PyPI, imitating a legitimate library. During installation, the package executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
PyPITyposquattingCompromised package - containedcritical
Malicious code in fast-hashes (PyPI)
A malicious package named fast-hashes was published to PyPI, using typosquatting to imitate a legitimate library. During installation, obfuscated code downloads and executes a remote malicious executable that exfiltrates cryptocurrency wallet data and potentially other sensitive information.
2026 08 Flasq CampaignPyPITyposquattingCompromised package