Malicious code in xoloqmotdjpbic (PyPI)
Malicious code was discovered in the xoloqmotdjpbic package on PyPI. The package was identified and reported by the OpenSSF malicious-packages project.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on package adoption and malicious payload scope
- Ecosystems
- Attack vectors
- Affected entities
- xoloqmotdjpbicPyPI package
The xoloqmotdjpbic package on PyPI was found to contain malicious code. This incident was identified and documented by the OpenSSF's malicious-packages project, which maintains a catalog of known malicious packages across package ecosystems.\n\nThe package was published on PyPI and made available to Python developers. The malicious code was detected and reported, leading to the package being flagged in security advisories.\n\nThis is a straightforward case of a malicious package being published to a public package repository, representing a direct supply chain attack vector against Python developers who may have installed or depended on this package.
Indicators of compromise
- Packages
- xoloqmotdjpbic
Remediation
- Remove xoloqmotdjpbic from all environments and dependencies
- Audit systems where xoloqmotdjpbic was installed for signs of compromise
- Review package dependencies to ensure no reliance on xoloqmotdjpbic
- Implement package verification and scanning in your dependency management workflow
- Monitor for similar typosquatting or malicious packages in your supply chain
Sources
- GitHub Advisory GHSA-2rrv-vfwm-xp4p · GitHub Advisory Database
Cite this entry
"Malicious code in xoloqmotdjpbic (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-xoloqmotdjpbic-pypi-0ev2vt
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedhigh
Malicious code in decapod-common (PyPI)
Malicious code was published in the decapod-common package on PyPI. The package exfiltrates basic host information (IP address, username) upon installation or import, with the malicious behavior executed via a setup.py install command override.
PyPICompromised package - containedcritical
Malicious code in uncrypt (PyPI)
The uncrypt package on PyPI contained malicious code that silently executes an embedded executable upon import, harvesting browser data and system information (IP, username) and communicating with an external domain. The package included obfuscation and sandbox detection capabilities.
PyPICompromised package - containedcritical
Malicious code in solana-sniper-bot (PyPI)
The solana-sniper-bot package on PyPI contained malicious code that exfiltrated sensitive data during installation, including environment variables, browser data, cryptocurrency wallet files, SSH keys, and configuration files. The malicious behavior was executed via a custom install command in setup.py.
PyPICompromised package - containedcritical
Malicious code in eth-account-wallet (PyPI)
The PyPI package eth-account-wallet contained malicious code that exfiltrated sensitive data during installation, including environment variables, browser data, cryptocurrency wallet files, SSH keys, and credentials. The malicious behavior was triggered via a setup.py install command override.
2026 08 Bip39 PYPyPICompromised package