Malicious code in govapkg (PyPI)
govapkg, a malicious PyPI package, downloads and executes a hidden binary on first use, establishing persistence via a systemd desktop autostart entry. The package obfuscates its malicious behavior through base64-encoded URLs and downloads from unverified external sources.
- Disclosed
- Last updated
- Blast radius
- Any Python environment that installed and used govapkg
- Ecosystems
- Attack vectors
- Affected entities
- govapkgPyPI package presenting as a Go pkg.dev client
govapkg is a malicious package published to PyPI that masquerades as a client for Go's pkg.dev documentation service. When any of its public API functions (get/package/module) are invoked, the package triggers an internal helper that base64-decodes a hidden URL pointing to https://teeny-cent.surge.sh/client.
The package downloads the response to ~/.local/bin/systemdserv, sets executable permissions, and spawns it as a detached subprocess. It then writes a desktop autostart entry at ~/.config/autostart/systemdserv.desktop with the Name field set to 'Systemd Service Manager', establishing user-level persistence that re-executes the attacker binary on every desktop login.
The malicious binary connects to telegra.ph using a URL template (https://api.telegra.ph/getPage/whisperer-MM-DD) that includes an advertisement for a Telegram channel. The attack chain uses multiple obfuscation techniques: base64 encoding of the download URL to evade string-based detection, an anonymous static-hosting domain unrelated to the package's advertised purpose, and no cryptographic verification of the downloaded executable.
The incident was identified through GitHub Security Advisory GHSA-pxxf-hj67-hjm5 and reported by both Amazon Inspector and kam193.
Indicators of compromise
- Packages
- govapkg
- Domains
- teeny-cent.surge.sh
- telegra.ph
Remediation
- Immediately uninstall govapkg from all affected systems: pip uninstall govapkg
- Remove any dropped binaries: rm -f ~/.local/bin/systemdserv
- Remove persistence mechanisms: rm -f ~/.config/autostart/systemdserv.desktop
- Audit system logs and process history for execution of systemdserv or connections to telegra.ph
- Review ~/.local/bin/ and ~/.config/autostart/ for other suspicious entries
- Consider full system audit if the binary was executed, as it may have established additional persistence or exfiltrated data
- Block teeny-cent.surge.sh and telegra.ph at network perimeter if possible
Sources
- GitHub Advisory GHSA-pxxf-hj67-hjm5 · GitHub Advisory Database
Cite this entry
"Malicious code in govapkg (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-govapkg-pypi-1rm9sx
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in dev-helper-bg (PyPI)
The PyPI package dev-helper-bg contained malicious code that executed arbitrary commands on import. The package decrypted and executed remotely-controlled code fetched from an external endpoint, and spawned a Telegram bot for command and control.
2026 07 Make HelperPyPICompromised packageMalicious commit - containedcritical
Malicious code in karpatkit (PyPI)
The karpatkit package on PyPI contained malicious code that exfiltrated sensitive credentials and secrets on import. The package spawned a daemon thread collecting environment variables, cloud credentials, SSH keys, Kubernetes tokens, cryptocurrency wallets, and shell histories, then transmitted them via HTTP to hardcoded IP addresses.
PyPICompromised packageMalicious commit - containedcritical
Malicious code in karpatkey (PyPI)
The karpatkey package on PyPI contained malicious code that exfiltrated sensitive credentials and data from infected systems. Upon import, the package spawned a background daemon thread that collected SSH keys, AWS/GCP credentials, kubeconfig, cryptocurrency wallets, and other secrets, then transmitted them via HTTP to hardcoded IP addresses.
PyPICompromised packageMalicious commit - resolvedhigh
Malicious code in advdef01 (PyPI)
The PyPI package advdef01 contained malicious code designed to exfiltrate system information (IP address, username) during installation. The package used a setup.py override to execute the malicious payload when installed.
PyPICompromised packageMalicious commit