Malicious code in ysocks (PyPI)
Malicious code was distributed in the ysocks package on PyPI as part of a campaign distributing 900+ malicious packages. The malicious packages installed browser extensions designed to manipulate clipboard contents and replace cryptocurrency wallet addresses.
- Disclosed
- Last updated
- Blast radius
- 900+ malicious packages distributed via PyPI
- Ecosystems
- Attack vectors
- Affected entities
- ysocksPyPI package
An attacker distributed over 900 malicious packages via PyPI, including the ysocks package. The malicious code installed browser extensions on infected systems with the capability to manipulate clipboard contents and replace cryptocurrency wallet addresses, enabling theft of cryptocurrency transactions.\n\nThe ysocks package was identified as part of this broader malicious package campaign. The attack targeted users installing these packages via pip, with the malicious extensions executing in the background to intercept and modify clipboard data related to cryptocurrency transactions.\n\nThis incident was documented by Checkmarx and credited to the OpenSSF's malicious-packages repository, which tracks confirmed malicious package distributions across package managers.
Indicators of compromise
- Packages
- ysocks
Remediation
- Immediately uninstall the ysocks package and any other packages from the 900+ malicious package list
- Audit system for installed browser extensions, particularly those installed without user consent
- Review clipboard history and recent cryptocurrency transactions for signs of address manipulation
- Change cryptocurrency wallet passwords and review transaction history for unauthorized transfers
- Monitor for unauthorized browser extensions and remove any suspicious extensions
- Use package manager security tools to scan for other potentially malicious packages in your environment
Sources
- GitHub Advisory GHSA-q52v-7ggh-qrgp · GitHub Advisory Database
Cite this entry
"Malicious code in ysocks (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-ysocks-pypi-ta7udk
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in afrit-name (PyPI)
Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adv2099m7 (PyPI)
Malicious code was discovered in the adv2099m7 package on PyPI. The package was identified and cataloged by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adrandom (PyPI)
The adrandom package on PyPI contained malicious code that executed spyware and information-stealing malware. It was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.
EsquelesquadPyPICompromised package - resolvedcritical
Malicious code in ziphash (PyPI)
The ziphash package on PyPI contained malicious code that downloads and executes multi-stage malware during archive-support class initialization. The malware exhibits obfuscation and remote code execution capabilities, classified as part of the 2025-11-uzip campaign.
2025 11 UzipPyPICompromised package