Malicious code in kb-ai (PyPI)
The kb-ai package on PyPI contained malicious code designed to demonstrate a dependency confusion attack. The package exfiltrated basic system data (IP address, username) and executed arbitrary code during installation via setup.py override.
- Disclosed
- Last updated
- Blast radius
- PyPI users who installed the malicious kb-ai package
- Ecosystems
- Attack vectors
- Affected entities
- kb-aiPyPI package containing malicious code
The kb-ai package published on PyPI contained intentionally malicious code. According to the OpenSSF malicious-packages repository, the package was designed primarily to demonstrate a dependency confusion attack, with the remaining functionality serving as stubs.
The malicious payload included code to exfiltrate basic system information such as IP address and username. The attack vector was implemented by overriding the install command in setup.py to execute malicious code during package installation, ensuring execution on any system that installed the package.
The incident was categorized as a pentest/research package with limited real-world harm potential, though it still posed a data exfiltration risk to affected users. The package was identified and documented by the OpenSSF's malicious-packages project.
Indicators of compromise
- Packages
- kb-ai
Remediation
- Remove kb-ai from affected systems immediately
- Audit system logs for suspicious activity during the installation window
- Review any system data that may have been exfiltrated (IP addresses, usernames)
- Use dependency scanning tools to detect similar malicious packages
- Verify package integrity and source before installation in future deployments
Sources
- GitHub Advisory GHSA-34mp-hr4q-qvh5 · GitHub Advisory Database
Cite this entry
"Malicious code in kb-ai (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 16, 2026; last updated August 16, 2026. https://supplychainattack.org/incident/malicious-code-in-kb-ai-pypi-uae4hi
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in neutrl-contracts (PyPI)
The PyPI package neutrl-contracts intentionally depends on a malicious package (neutrl-core) that exfiltrates sensitive credentials including environment variables, SSH keys, and dotenv files. The malicious code is disguised as telemetry and activated remotely by an attacker-controlled endpoint.
PyPICompromised packageDependency confusion - containedcritical
Malicious code in plp-contract (PyPI)
The PyPI package plp-contract intentionally depends on a malicious package (neutrl-core) designed to exfiltrate sensitive credentials including environment variables, SSH keys, and dotenv files. The malicious code is disguised as telemetry and activates via remote command delivery from an attacker-controlled endpoint.
2026 08 Neutrl CorePyPICompromised packageDependency confusion - resolvedhigh
Malicious code in cubesat-upstream-driver (PyPI)
Malicious code was published to PyPI in the cubesat-upstream-driver package, capable of collecting environment variables. The package was detected as part of a CTF-like exercise or pentest campaign and does not appear to exfiltrate data autonomously.
PyPICompromised packageDependency confusion - resolvedhigh
Malicious code in atlas-internal (PyPI)
Multiple malicious versions of atlas-internal were published to PyPI containing code that exfiltrates host information (hostname, working directory, username) during installation. The package overrides the egg_info command in setup.py to execute automatically on pip install without user interaction, sending collected data to attacker-controlled out-of-band callback servers.
PyPICompromised packageDependency confusion