Malicious code in karpatkey (PyPI)
The karpatkey package on PyPI contained malicious code that exfiltrated sensitive credentials and data from infected systems. Upon import, the package spawned a background daemon thread that collected SSH keys, AWS/GCP credentials, kubeconfig, cryptocurrency wallets, and other secrets, then transmitted them via HTTP to hardcoded IP addresses.
- Disclosed
- Last updated
- Blast radius
- All Python environments that imported the malicious karpatkey package versions
- Ecosystems
- Attack vectors
- Affected entities
- karpatkeyPyPI package containing malicious code in __init__.py and _compat.py
The karpatkey package distributed via PyPI contained malicious code designed to exfiltrate sensitive data from developers' systems. When the package was imported, the top-level karpatkey/__init__.py spawned a background daemon thread that systematically collected credentials and secrets from multiple sources.
The malicious code targeted a wide range of sensitive data including SSH private keys (~/.ssh/id_*), AWS credentials (~/.aws/credentials), GCP credentials (~/.config/gcloud/), kubeconfig files (~/.kube/config), Ethereum wallet keystores (~/.ethereum/keystore/*), GnuPG private keys (~/.gnupg/private-keys-v1.d/*), package manager credentials (.npmrc, .pypirc), Docker and Git credentials, shell histories, environment files, Kubernetes service-account tokens, and the full process environment variables.
The collected data was archived, zipped, base64-encoded, and exfiltrated via plain HTTP POST requests to two hardcoded IP addresses: 185.158.107.189:8877 and 151.247.22.13:8877. The IP addresses were obfuscated as integer tuples in an _ANALYTICS list and reassembled at runtime. The malicious module karpatkey/_compat.py falsely presented itself as a "Runtime environment compatibility layer" to disguise the exfiltration activity.
The incident was identified and reported through GitHub Security Advisories (GHSA-v497-gp55-jwxm) with source attribution to amazon-inspector and kam193.
Indicators of compromise
- Packages
- karpatkey
- IPs
- 185.158.107.189
- 151.247.22.13
Remediation
- Immediately uninstall the karpatkey package from all affected systems
- Rotate all SSH keys, AWS credentials, GCP credentials, and other secrets that may have been exposed
- Change passwords for all accounts that may have been compromised
- Review shell history and environment variables for any suspicious activity
- Monitor cryptocurrency wallets and accounts for unauthorized access
- Audit Kubernetes clusters and service accounts for unauthorized access
- Check git and npm credentials for unauthorized use
- Consider this a full system compromise and perform a security audit of all affected machines
- Review PyPI package integrity and verify the legitimate publisher of karpatkey
Sources
- GitHub Advisory GHSA-v497-gp55-jwxm · GitHub Advisory Database
Cite this entry
"Malicious code in karpatkey (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-karpatkey-pypi-h42vq4
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in govapkg (PyPI)
govapkg, a malicious PyPI package, downloads and executes a hidden binary on first use, establishing persistence via a systemd desktop autostart entry. The package obfuscates its malicious behavior through base64-encoded URLs and downloads from unverified external sources.
PyPICompromised packageMalicious commit - containedcritical
Malicious code in dev-helper-bg (PyPI)
The PyPI package dev-helper-bg contained malicious code that executed arbitrary commands on import. The package decrypted and executed remotely-controlled code fetched from an external endpoint, and spawned a Telegram bot for command and control.
2026 07 Make HelperPyPICompromised packageMalicious commit - containedcritical
Malicious code in karpatkit (PyPI)
The karpatkit package on PyPI contained malicious code that exfiltrated sensitive credentials and secrets on import. The package spawned a daemon thread collecting environment variables, cloud credentials, SSH keys, Kubernetes tokens, cryptocurrency wallets, and shell histories, then transmitted them via HTTP to hardcoded IP addresses.
PyPICompromised packageMalicious commit - resolvedhigh
Malicious code in advdef01 (PyPI)
The PyPI package advdef01 contained malicious code designed to exfiltrate system information (IP address, username) during installation. The package used a setup.py override to execute the malicious payload when installed.
PyPICompromised packageMalicious commit