Malicious code in youreallydontwantthispackage2132 (PyPI)
Malicious code was published in the PyPI package youreallydontwantthispackage2132 version 1.0.3. The package executes malicious code during installation via setup.py override and communicates with domains associated with malicious activity, exfiltrating environment variables and other data.
- Disclosed
- Last updated
- Blast radius
- All users who installed youreallydontwantthispackage2132 version 1.0.3 from PyPI
- Ecosystems
- Attack vectors
- Affected entities
- youreallydontwantthispackage2132 · 1.0.3
The PyPI package 'youreallydontwantthispackage2132' version 1.0.3 was identified as malicious by both the OpenSSF Package Analysis project and security researchers. The package was designed to execute arbitrary code during installation by overriding the install command in setup.py.\n\nThe malicious payload exfiltrates sensitive data including environment variables and other system information. The package also communicates with domains known to be associated with malicious activity. Analysis indicates this was part of a generic campaign targeting research and penetration testing environments, raising questions about privacy and security implications.\n\nThe package appears to employ typosquatting tactics as part of its distribution strategy. Both the OpenSSF and independent researchers (kam193) confirmed the malicious nature of the package through code analysis and behavioral detection.
Indicators of compromise
- Packages
- youreallydontwantthispackage2132
Remediation
- Immediately uninstall youreallydontwantthispackage2132 from all systems
- Audit environment variables and secrets that may have been exposed during package installation
- Review system logs for any suspicious activity or data exfiltration following installation
- Check for any outbound connections to the malicious domains identified in the analysis
- Regenerate any credentials or secrets that may have been present in environment variables at the time of installation
- Monitor systems for persistence mechanisms that may have been installed by the malicious package
Sources
- GitHub Advisory GHSA-rr7m-4fgx-j2c8 · GitHub Advisory Database
Cite this entry
"Malicious code in youreallydontwantthispackage2132 (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-youreallydontwantthispackage2132-pypi-0glxfb
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedhigh
Malicious code in adandu (PyPI)
The PyPI package 'adandu' was identified as malicious, containing code to exfiltrate basic system information (hostname, path, username) upon installation or import. The package was part of a broader campaign of pentest-themed malicious packages and communicated with domains associated with malicious activity.
PyPICompromised packageTyposquattingDependency confusion - resolvedcritical
Malicious code in yelp-pkg (PyPI)
yelp-pkg, a malicious package on PyPI, was designed to exfiltrate sensitive data including environment variables during installation. The package overrides the install command in setup.py to execute malicious code and appears to be a typosquatting attack.
PyPICompromised packageTyposquatting - resolvedhigh
Malicious code in adandv (PyPI)
The adandv package on PyPI contained malicious code designed to exfiltrate basic system information (hostname, path, username) to the package author. The package was part of a broader campaign of malicious pentest-themed packages flooding PyPI.
PyPICompromised packageTyposquattingDependency confusion - resolvedcritical
Malicious code in zamino (PyPI)
The PyPI package zamino was identified as malicious code—a clone of legitimate Aminoapps libraries with added credential exfiltration functionality. The package was part of the 2025-06-sorex campaign and has been cataloged by the OpenSSF malicious packages database.
2025 06 SorexPyPICompromised packageTyposquatting