Malicious code in karpatkey (PyPI)
The karpatkey package on PyPI contained malicious code that exfiltrated sensitive credentials and data from infected systems. Upon import, the package spawned a background daemon thread that collected SSH keys, AWS/GCP credentials, kubeconfig, cryptocurrency wallets, and other secrets, then transmitted them via HTTP to hardcoded IP addresses.
- Disclosed
- Last updated
- Blast radius
- All Python environments that imported the malicious karpatkey package versions
- Ecosystems
- Attack vectors
- Affected entities
- karpatkeyPyPI package containing malicious code in __init__.py and _compat.py
The karpatkey package distributed via PyPI contained malicious code designed to exfiltrate sensitive data from developers' systems. When the package was imported, the top-level karpatkey/__init__.py spawned a background daemon thread that systematically collected credentials and secrets from multiple sources.
The malicious code targeted a wide range of sensitive data including SSH private keys (~/.ssh/id_*), AWS credentials (~/.aws/credentials), GCP credentials (~/.config/gcloud/), kubeconfig files (~/.kube/config), Ethereum wallet keystores (~/.ethereum/keystore/*), GnuPG private keys (~/.gnupg/private-keys-v1.d/*), package manager credentials (.npmrc, .pypirc), Docker and Git credentials, shell histories, environment files, Kubernetes service-account tokens, and the full process environment variables.
The collected data was archived, zipped, base64-encoded, and exfiltrated via plain HTTP POST requests to two hardcoded IP addresses: 185.158.107.189:8877 and 151.247.22.13:8877. The IP addresses were obfuscated as integer tuples in an _ANALYTICS list and reassembled at runtime. The malicious module karpatkey/_compat.py falsely presented itself as a "Runtime environment compatibility layer" to disguise the exfiltration activity.
The incident was identified and reported through GitHub Security Advisories (GHSA-v497-gp55-jwxm) with source attribution to amazon-inspector and kam193.
Indicators of compromise
- Packages
- karpatkey
- IPs
- 185.158.107.189
- 151.247.22.13
Remediation
- Immediately uninstall the karpatkey package from all affected systems
- Rotate all SSH keys, AWS credentials, GCP credentials, and other secrets that may have been exposed
- Change passwords for all accounts that may have been compromised
- Review shell history and environment variables for any suspicious activity
- Monitor cryptocurrency wallets and accounts for unauthorized access
- Audit Kubernetes clusters and service accounts for unauthorized access
- Check git and npm credentials for unauthorized use
- Consider this a full system compromise and perform a security audit of all affected machines
- Review PyPI package integrity and verify the legitimate publisher of karpatkey
Sources
- GitHub Advisory GHSA-v497-gp55-jwxm · GitHub Advisory Database
Cite this entry
"Malicious code in karpatkey (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-karpatkey-pypi-h42vq4
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in alphalend-layouts (PyPI)
The PyPI package alphalend-layouts contained malicious code that harvested Sui keystores, private keys, and environment secrets from installer systems and uploaded them to an attacker-controlled GitHub repository. The attack was triggered both during installation and on first import, with credentials deliberately obfuscated to evade detection.
PyPICompromised packageMalicious commit - containedcritical
Malicious code in aichannel (PyPI)
Multiple malicious PyPI packages (aichannel, cognikit, aiassistcore) were published as part of a coordinated campaign attributed to North Korea's "Contagious Interview" operation. The packages contain infostealer functionality including cryptocurrency wallet address replacement, browser data exfiltration, keylogging, clipboard monitoring, and remote access capabilities.
Contagious InterviewPyPICompromised packageMalicious commit - containedcritical
Malicious code in ailaunchkit (PyPI)
A coordinated campaign of malicious Python packages on PyPI (ailaunchkit, cognikit, aiassistcore, aichannel) was discovered containing infostealer malware. The packages implement cryptocurrency wallet address replacement, browser data exfiltration, remote access, and malicious browser extension installation, with IoCs consistent with North Korea's "Contagious Interview" campaign.
Contagious InterviewPyPICompromised packageMalicious commit - containedcritical
Malicious code in aiassistcore (PyPI)
Multiple malicious PyPI packages (aiassistcore, cognikit, aichannel) were discovered containing infostealer functionality, cryptocurrency wallet address replacement, browser data exfiltration, and remote access capabilities. The campaign, attributed to North Korean threat actors, uses these packages as dependencies in malicious interview assessments and cryptocurrency projects.
Contagious InterviewPyPICompromised packageMalicious commit