Malicious code in yt-api-dlp (PyPI)
yt-api-dlp, a typosquat of the legitimate yt-dlp package on PyPI, contains malicious code that downloads encrypted payloads and communicates with a C2 server via the Polygon blockchain during import. The package was a near-verbatim copy of yt-dlp with added malicious functionality.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on installation count of yt-api-dlp before removal.
- Ecosystems
- Attack vectors
- Affected entities
- yt-api-dlpMalicious package on PyPI; typosquat of yt-dlp
The package yt-api-dlp was published on PyPI as a single-token typosquat of the widely-used yt-dlp package. The tarball contained a near-verbatim copy of yt-dlp source (version 2026.06.09) republished under a different name with blank project metadata.
Analysis revealed two distinct malicious behaviors. One analysis noted that aside from an added print("The Unlicense") statement in init.py, the package mirrored upstream yt-dlp behavior with no exfiltration, dropper, or backdoor present. However, a second analysis identified that during import, the malicious copy downloads encrypted data disguised as an image, containing an archive with a next-stage script that uses the Polygon blockchain (contract 0xC7c9026a3a7e27ec6Ce2D09B19FC1FB4bc978BBb) to retrieve a C2 address, then communicates with the C2 server over an encrypted channel to receive further commands.
The attack leverages name confusion to trick users into installing the malicious package instead of the legitimate yt-dlp. The malicious functionality is triggered at import time, making it active as soon as the package is imported by any code.
Indicators of compromise
- Packages
- yt-api-dlp
- Hashes
- d4710e1aa4fe025aaed51f4958f3b514a6cb950b40069f424c7a5d9a2f85591c
- c3b9ca286cef4b241ded9603c192ce5b13e155cad9b017ee3f89b98674065374
Remediation
- Immediately uninstall yt-api-dlp from any affected systems
- Audit systems that may have imported yt-api-dlp for signs of C2 communication or command execution
- Use only the legitimate yt-dlp package from PyPI (verify package name spelling carefully)
- Monitor for similar typosquat packages on PyPI
- Consider using dependency pinning and verification to prevent accidental installation of similarly-named packages
Sources
- GitHub Advisory GHSA-gcfv-55gr-xh44 · GitHub Advisory Database
Cite this entry
"Malicious code in yt-api-dlp (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-yt-api-dlp-pypi-18our6
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedhigh
Malicious code in adandu (PyPI)
The PyPI package 'adandu' was identified as malicious, containing code to exfiltrate basic system information (hostname, path, username) upon installation or import. The package was part of a broader campaign of pentest-themed malicious packages and communicated with domains associated with malicious activity.
PyPICompromised packageTyposquattingDependency confusion - resolvedcritical
Malicious code in yelp-pkg (PyPI)
yelp-pkg, a malicious package on PyPI, was designed to exfiltrate sensitive data including environment variables during installation. The package overrides the install command in setup.py to execute malicious code and appears to be a typosquatting attack.
PyPICompromised packageTyposquatting - resolvedhigh
Malicious code in adandv (PyPI)
The adandv package on PyPI contained malicious code designed to exfiltrate basic system information (hostname, path, username) to the package author. The package was part of a broader campaign of malicious pentest-themed packages flooding PyPI.
PyPICompromised packageTyposquattingDependency confusion - resolvedcritical
Malicious code in zamino (PyPI)
The PyPI package zamino was identified as malicious code—a clone of legitimate Aminoapps libraries with added credential exfiltration functionality. The package was part of the 2025-06-sorex campaign and has been cataloged by the OpenSSF malicious packages database.
2025 06 SorexPyPICompromised packageTyposquatting