Malicious code in karpatkit (PyPI)
The karpatkit package on PyPI contained malicious code that exfiltrated sensitive credentials and secrets on import. The package spawned a daemon thread collecting environment variables, cloud credentials, SSH keys, Kubernetes tokens, cryptocurrency wallets, and shell histories, then transmitted them via HTTP to hardcoded IP addresses.
- Disclosed
- Last updated
- Blast radius
- Any user who imported the malicious karpatkit package from PyPI; potential exposure of environment variables, cloud credentials, SSH keys, Kubernetes tokens, cryptocurrency wallets, and shell histories.
- Ecosystems
- Attack vectors
- Affected entities
- karpatkitPyPI package containing malicious code in __init__.py
The karpatkit package published on PyPI contained malicious code embedded in its top-level __init__.py file. Upon import, the package invoked _compat.check() which spawned a daemon thread designed to collect sensitive data from the user's system.\n\nThe exfiltration targeted a wide range of sensitive files and data, including: OS environment variables, Kubernetes service-account tokens, SSH private keys (~/.ssh/id_*), AWS credentials (~/.aws/credentials), Google Cloud configuration (~/.config/gcloud/*.json), Kubernetes configuration (~/.kube/config), npm and PyPI credentials (~/.npmrc, ~/.pypirc), Docker configuration (~/.docker/config.json), Git credentials (~/.gitconfig, ~/.git-credentials), GnuPG private keys (~/.gnupg), Ethereum wallet keystores (~/.ethereum/keystore/*), shell histories, and .env* files.\n\nThe collected data was zipped, base64-encoded into a JSON report field, and transmitted via plain HTTP POST to two hardcoded bare-IP endpoints: 185.158.107.189:8877 and 151.247.22.13:8877. The IP addresses were obfuscated as integer tuples in an _ANALYTICS variable and reassembled at runtime. Additional obfuscation techniques included variable aliasing, misleading naming conventions, and base64 encoding of payload contents.\n\nThe package was identified through GitHub Security Advisory GHSA-7qg7-6pg7-g63q and appears to have been removed or contained by the time of public disclosure.
Indicators of compromise
- Packages
- karpatkit
- IPs
- 185.158.107.189
- 151.247.22.13
Remediation
- Immediately uninstall karpatkit from all systems: pip uninstall karpatkit
- Rotate all credentials and secrets that may have been exposed, including: AWS credentials, GCP service account keys, SSH private keys, Kubernetes tokens, npm/PyPI tokens, Docker credentials, Git credentials, and cryptocurrency wallet keys
- Review shell history and environment variable logs for any suspicious activity or data exfiltration
- Monitor the hardcoded IP addresses (185.158.107.189:8877 and 151.247.22.13:8877) for any outbound connections from your systems
- Audit all systems where karpatkit was imported to identify what sensitive data may have been collected
- Consider this a critical security incident and treat all exposed credentials as compromised
Sources
- GitHub Advisory GHSA-7qg7-6pg7-g63q · GitHub Advisory Database
Cite this entry
"Malicious code in karpatkit (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-karpatkit-pypi-1niosu
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in govapkg (PyPI)
govapkg, a malicious PyPI package, downloads and executes a hidden binary on first use, establishing persistence via a systemd desktop autostart entry. The package obfuscates its malicious behavior through base64-encoded URLs and downloads from unverified external sources.
PyPICompromised packageMalicious commit - containedcritical
Malicious code in dev-helper-bg (PyPI)
The PyPI package dev-helper-bg contained malicious code that executed arbitrary commands on import. The package decrypted and executed remotely-controlled code fetched from an external endpoint, and spawned a Telegram bot for command and control.
2026 07 Make HelperPyPICompromised packageMalicious commit - containedcritical
Malicious code in karpatkey (PyPI)
The karpatkey package on PyPI contained malicious code that exfiltrated sensitive credentials and data from infected systems. Upon import, the package spawned a background daemon thread that collected SSH keys, AWS/GCP credentials, kubeconfig, cryptocurrency wallets, and other secrets, then transmitted them via HTTP to hardcoded IP addresses.
PyPICompromised packageMalicious commit - resolvedhigh
Malicious code in advdef01 (PyPI)
The PyPI package advdef01 contained malicious code designed to exfiltrate system information (IP address, username) during installation. The package used a setup.py override to execute the malicious payload when installed.
PyPICompromised packageMalicious commit