Malicious code in plp-contract (PyPI)
The PyPI package plp-contract intentionally depends on a malicious package (neutrl-core) designed to exfiltrate sensitive credentials including environment variables, SSH keys, and dotenv files. The malicious code is disguised as telemetry and activates via remote command delivery from an attacker-controlled endpoint.
- Disclosed
- Last updated
- Blast radius
- Unknown; plp-contract and its dependency neutrl-core affected; scope of downstream users unclear from source
- Ecosystems
- Attack vectors
- Threat actor
- Affected entities
- plp-contractPyPI package containing malicious dependency
- neutrl-coreMalicious dependency package containing exfiltration code
The plp-contract package on PyPI was found to intentionally depend on a malicious package as part of a coordinated supply chain attack campaign (2026-08-neutrl-core). The malicious code is embedded in the dependency package neutrl-core, where it is disguised as telemetry functionality.
The attack is designed to exfiltrate sensitive data including environment variables, SSH keys, dotenv files, and other credentials. The malicious code includes remote command execution capabilities that activate when the attacker-controlled endpoint delivers commands. The attacker ensures their malicious endpoint is always included in the configuration, even if users attempt to provide their own blockchain endpoints.
Analysis indicates that in the examined versions, the dependent packages did not actively use the malicious code but were clearly prepared for the attack. The related GitHub account used to distribute these packages employed deceptive practices, including publishing repositories with backdated commits despite the account being created after those commit dates.
The campaign was identified and credited to the OpenSSF's malicious-packages project.
Indicators of compromise
- Packages
- plp-contract
- neutrl-core
Remediation
- Remove plp-contract and neutrl-core from all environments immediately
- Audit environment variables, SSH keys, and credential stores for unauthorized access or exfiltration
- Review logs for any outbound connections to attacker-controlled endpoints
- Rotate all credentials (SSH keys, API tokens, passwords) that may have been exposed
- Scan systems for any remote command execution artifacts or persistence mechanisms
- Monitor for any unusual activity or data exfiltration from affected systems
Sources
- GitHub Advisory GHSA-4crr-q8rh-wqrg · GitHub Advisory Database
Cite this entry
"Malicious code in plp-contract (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 10, 2026; last updated August 10, 2026. https://supplychainattack.org/incident/malicious-code-in-plp-contract-pypi-1nozp0
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedhigh
Malicious code in kb-ai (PyPI)
The kb-ai package on PyPI contained malicious code designed to demonstrate a dependency confusion attack. The package exfiltrated basic system data (IP address, username) and executed arbitrary code during installation via setup.py override.
PyPICompromised packageDependency confusion - resolvedcritical
Malicious code in neutrl-contracts (PyPI)
The PyPI package neutrl-contracts intentionally depends on a malicious package (neutrl-core) that exfiltrates sensitive credentials including environment variables, SSH keys, and dotenv files. The malicious code is disguised as telemetry and activated remotely by an attacker-controlled endpoint.
PyPICompromised packageDependency confusion - resolvedhigh
Malicious code in cubesat-upstream-driver (PyPI)
Malicious code was published to PyPI in the cubesat-upstream-driver package, capable of collecting environment variables. The package was detected as part of a CTF-like exercise or pentest campaign and does not appear to exfiltrate data autonomously.
PyPICompromised packageDependency confusion - resolvedhigh
Malicious code in atlas-internal (PyPI)
Multiple malicious versions of atlas-internal were published to PyPI containing code that exfiltrates host information (hostname, working directory, username) during installation. The package overrides the egg_info command in setup.py to execute automatically on pip install without user interaction, sending collected data to attacker-controlled out-of-band callback servers.
PyPICompromised packageDependency confusion