Malicious code in ygame (PyPI)
Attacker distributed 900+ malicious packages via PyPI, including ygame, containing code that infected local browsers with malicious extensions designed to manipulate clipboard and replace cryptocurrency wallet addresses.
- Disclosed
- Last updated
- Blast radius
- 900+ malicious packages distributed via PyPI
- Ecosystems
- Attack vectors
- Affected entities
- ygamePyPI package
An attacker distributed over 900 malicious packages via the Python Package Index (PyPI), with ygame being one of the affected packages. The malicious code was designed to install browser extensions on infected systems.\n\nThe malicious extensions targeted cryptocurrency users by manipulating the clipboard and replacing legitimate wallet addresses with attacker-controlled addresses, enabling theft of cryptocurrency transfers.\n\nThis incident was identified and documented by the OpenSSF's malicious-packages repository (MAL-2023-2463). The attack represents a significant supply chain compromise affecting PyPI users who installed any of the 900+ malicious packages.
Indicators of compromise
- Packages
- ygame
Remediation
- Remove and uninstall the ygame package and any other packages from the 900+ malicious package set immediately
- Audit system for installed browser extensions and remove any suspicious or unfamiliar extensions
- Review cryptocurrency wallet addresses in clipboard history and verify no unauthorized transactions occurred
- Check browser history and settings for unauthorized changes
- Consider regenerating cryptocurrency wallet addresses and transferring funds if compromise is suspected
- Monitor PyPI for security advisories and use dependency scanning tools to detect malicious packages
Sources
- GitHub Advisory GHSA-5hg5-hwf7-m867 · GitHub Advisory Database
Cite this entry
"Malicious code in ygame (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed January 1, 2023; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-ygame-pypi-8buuno
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in afrit-name (PyPI)
Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adv2099m7 (PyPI)
Malicious code was discovered in the adv2099m7 package on PyPI. The package was identified and cataloged by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adrandom (PyPI)
The adrandom package on PyPI contained malicious code that executed spyware and information-stealing malware. It was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.
EsquelesquadPyPICompromised package - resolvedcritical
Malicious code in ziphash (PyPI)
The ziphash package on PyPI contained malicious code that downloads and executes multi-stage malware during archive-support class initialization. The malware exhibits obfuscation and remote code execution capabilities, classified as part of the 2025-11-uzip campaign.
2025 11 UzipPyPICompromised package