Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in xayoub-xctxteam (PyPI)

The xayoub-xctxteam package on PyPI contained malicious code that, upon import, spawned a Flask HTTP server on 0.0.0.0:50019 and background threads to automate spam and abuse traffic using hardcoded gaming credentials. The package exposed an unauthenticated remote-control interface and shipped cleartext credentials and OAuth secrets.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any system that installed and imported the xayoub-xctxteam package from PyPI; the package exposes an unauthenticated remote-control interface and uses the installer's IP for abuse traffic generation.
Ecosystems
PyPI
Attack vectors
Compromised package
Affected entities
  • xayoub-xctxteamPyPI package containing malicious code

The xayoub-xctxteam package published on PyPI contained malicious code designed to execute automatically on import. Upon importing the package, the init.py file would start a Flask HTTP server listening on 0.0.0.0:50019, exposing endpoints including /spam?uid=, /stop, and /status that allowed any remote party able to reach the installer's host to trigger outbound abuse traffic.

In parallel, the package spawned background threads that logged into approximately 20 hardcoded Garena Free Fire guest accounts (shipped as accounts.json in the source distribution) against loginbp.ggpolarbear.com and 100067.connect.garena.com using hardcoded OAuth credentials (client_id=100067 and client_secret). These threads would open game rooms and emit invite-spam packets to attacker-supplied targets.

The package disabled TLS verification for game-service HTTPS calls and shipped 20 uid:password pairs and a Garena OAuth client secret in cleartext within the distribution. Installation and import of this package exposed an unauthenticated remote-control interface on the installer's host and leveraged the installer's IP address as a source for abuse traffic against third-party services.

The incident was identified and credited to the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • xayoub-xctxteam

Remediation

  • Immediately uninstall the xayoub-xctxteam package from all affected systems
  • Audit systems that imported this package for unauthorized network connections and abuse traffic
  • Rotate any credentials or OAuth tokens that may have been exposed or used by the malicious code
  • Monitor the installer's IP address for abuse reports and contact affected third-party services (Garena) to report the incident
  • Review PyPI package installation logs to identify all systems that may have installed this package
  • Implement package verification and code review practices before installing packages from public repositories

Sources

  1. GitHub Advisory GHSA-3q6h-q26c-838m · GitHub Advisory Database

Cite this entry

"Malicious code in xayoub-xctxteam (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 6, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-xayoub-xctxteam-pypi-10mdbo

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in @years19/n8n-nodes-utils-helper-c (npm)

    The npm package @years19/n8n-nodes-utils-helper-c contained a malicious postinstall script that downloads a trojanized Python multidict module from an attacker-controlled server and injects it into the system's Python site-packages directory, enabling arbitrary code execution on any subsequent Python invocation.

    npmPyPICompromised packageMalicious commit
  2. containedcritical

    Malicious code in @years19/n8n-nodes-utils-helper-d (npm)

    The npm package @years19/n8n-nodes-utils-helper-d contained malicious code that downloads and executes a Python DDoS/offensive-tooling dropper on installation. The package impersonates a legitimate n8n community node but performs unauthorized system reconnaissance and beacons host identity to an attacker-controlled endpoint.

    npmPyPICompromised packageTyposquatting
  3. resolvedcritical

    Malicious code in @years18/n8n-nodes-utils-helper-y (npm)

    The npm package @years18/n8n-nodes-utils-helper-y contained malicious code in its postinstall hook that downloads and executes attacker-controlled Python toolkits (mhddos, pyroxy-full, impacket), persists them in the user's Python site-packages, and exfiltrates host information to an attacker-controlled endpoint. Installation triggers immediate code execution and establishes persistence.

    npmPyPICompromised package
  4. resolvedcritical

    Malicious code in @years19/n8n-nodes-utils-helper-b (npm)

    The npm package @years19/n8n-nodes-utils-helper-b contained malicious code disguised as an n8n workflow utility. The postinstall hook executed reconnaissance, downloaded and extracted a Python tarball with TLS verification disabled, and exfiltrated system information to an attacker-controlled domain.

    npmPyPICompromised package