Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in karpatkit (PyPI)

The karpatkit package on PyPI contained malicious code that exfiltrated sensitive credentials and secrets on import. The package spawned a daemon thread collecting environment variables, cloud credentials, SSH keys, Kubernetes tokens, cryptocurrency wallets, and shell histories, then transmitted them via HTTP to hardcoded IP addresses.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any user who imported the malicious karpatkit package from PyPI; potential exposure of environment variables, cloud credentials, SSH keys, Kubernetes tokens, cryptocurrency wallets, and shell histories.
Ecosystems
PyPI
Attack vectors
Compromised packageMalicious commit
Affected entities
  • karpatkitPyPI package containing malicious code in __init__.py

The karpatkit package published on PyPI contained malicious code embedded in its top-level __init__.py file. Upon import, the package invoked _compat.check() which spawned a daemon thread designed to collect sensitive data from the user's system.\n\nThe exfiltration targeted a wide range of sensitive files and data, including: OS environment variables, Kubernetes service-account tokens, SSH private keys (~/.ssh/id_*), AWS credentials (~/.aws/credentials), Google Cloud configuration (~/.config/gcloud/*.json), Kubernetes configuration (~/.kube/config), npm and PyPI credentials (~/.npmrc, ~/.pypirc), Docker configuration (~/.docker/config.json), Git credentials (~/.gitconfig, ~/.git-credentials), GnuPG private keys (~/.gnupg), Ethereum wallet keystores (~/.ethereum/keystore/*), shell histories, and .env* files.\n\nThe collected data was zipped, base64-encoded into a JSON report field, and transmitted via plain HTTP POST to two hardcoded bare-IP endpoints: 185.158.107.189:8877 and 151.247.22.13:8877. The IP addresses were obfuscated as integer tuples in an _ANALYTICS variable and reassembled at runtime. Additional obfuscation techniques included variable aliasing, misleading naming conventions, and base64 encoding of payload contents.\n\nThe package was identified through GitHub Security Advisory GHSA-7qg7-6pg7-g63q and appears to have been removed or contained by the time of public disclosure.

Indicators of compromise

Packages
  • karpatkit
IPs
  • 185.158.107.189
  • 151.247.22.13

Remediation

  • Immediately uninstall karpatkit from all systems: pip uninstall karpatkit
  • Rotate all credentials and secrets that may have been exposed, including: AWS credentials, GCP service account keys, SSH private keys, Kubernetes tokens, npm/PyPI tokens, Docker credentials, Git credentials, and cryptocurrency wallet keys
  • Review shell history and environment variable logs for any suspicious activity or data exfiltration
  • Monitor the hardcoded IP addresses (185.158.107.189:8877 and 151.247.22.13:8877) for any outbound connections from your systems
  • Audit all systems where karpatkit was imported to identify what sensitive data may have been collected
  • Consider this a critical security incident and treat all exposed credentials as compromised

Sources

  1. GitHub Advisory GHSA-7qg7-6pg7-g63q · GitHub Advisory Database

Cite this entry

"Malicious code in karpatkit (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-karpatkit-pypi-1niosu

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in alphalend-layouts (PyPI)

    The PyPI package alphalend-layouts contained malicious code that harvested Sui keystores, private keys, and environment secrets from installer systems and uploaded them to an attacker-controlled GitHub repository. The attack was triggered both during installation and on first import, with credentials deliberately obfuscated to evade detection.

    PyPICompromised packageMalicious commit
  2. containedcritical

    Malicious code in aichannel (PyPI)

    Multiple malicious PyPI packages (aichannel, cognikit, aiassistcore) were published as part of a coordinated campaign attributed to North Korea's "Contagious Interview" operation. The packages contain infostealer functionality including cryptocurrency wallet address replacement, browser data exfiltration, keylogging, clipboard monitoring, and remote access capabilities.

    Contagious InterviewPyPICompromised packageMalicious commit
  3. containedcritical

    Malicious code in ailaunchkit (PyPI)

    A coordinated campaign of malicious Python packages on PyPI (ailaunchkit, cognikit, aiassistcore, aichannel) was discovered containing infostealer malware. The packages implement cryptocurrency wallet address replacement, browser data exfiltration, remote access, and malicious browser extension installation, with IoCs consistent with North Korea's "Contagious Interview" campaign.

    Contagious InterviewPyPICompromised packageMalicious commit
  4. containedcritical

    Malicious code in aiassistcore (PyPI)

    Multiple malicious PyPI packages (aiassistcore, cognikit, aichannel) were discovered containing infostealer functionality, cryptocurrency wallet address replacement, browser data exfiltration, and remote access capabilities. The campaign, attributed to North Korean threat actors, uses these packages as dependencies in malicious interview assessments and cryptocurrency projects.

    Contagious InterviewPyPICompromised packageMalicious commit