Malicious code in zakuchienne (PyPI)
The PyPI package zakuchienne contains malicious code that functions as an infostealer, exfiltrating credentials, browser data, and files. The malware includes sandbox detection capabilities and was identified as part of the 2025-11-mescouilles campaign.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on installation count and user environment exposure.
- Ecosystems
- Attack vectors
- Threat actor
- Affected entities
- zakuchiennePyPI package containing infostealer malware
The PyPI package zakuchienne was found to contain malicious code that executes upon module import. The malware is classified as an infostealer with capabilities including credential theft, browser data exfiltration, and generic file exfiltration.\n\nThe package includes code to detect sandbox environments, suggesting an attempt to evade automated analysis. The malware was identified and attributed to the 2025-11-mescouilles campaign by the OpenSSF's malicious-packages project (MAL-2025-191940).\n\nThe malicious code was discovered by kam193 and reported through GitHub's advisory system. Users who installed this package may have had sensitive information compromised.
Indicators of compromise
- Packages
- zakuchienne
- Hashes
- 6cab2f6ce1c1eec52747b1f7057550b9b35d3c4f6d8c04b51e37afd47c1e5625
Remediation
- Immediately uninstall the zakuchienne package from all systems
- Audit systems that had zakuchienne installed for signs of credential theft or unauthorized access
- Change passwords for any accounts that may have been exposed
- Review browser history and installed extensions for suspicious activity
- Monitor for unauthorized file access or exfiltration on affected systems
- Check PyPI and package management logs for installation records
Sources
- GitHub Advisory GHSA-qv3m-fjhj-jqw3 · GitHub Advisory Database
Cite this entry
"Malicious code in zakuchienne (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-zakuchienne-pypi-u8f8ub
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in afrit-name (PyPI)
Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adv2099m7 (PyPI)
Malicious code was discovered in the adv2099m7 package on PyPI. The package was identified and cataloged by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adrandom (PyPI)
The adrandom package on PyPI contained malicious code that executed spyware and information-stealing malware. It was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.
EsquelesquadPyPICompromised package - resolvedcritical
Malicious code in ziphash (PyPI)
The ziphash package on PyPI contained malicious code that downloads and executes multi-stage malware during archive-support class initialization. The malware exhibits obfuscation and remote code execution capabilities, classified as part of the 2025-11-uzip campaign.
2025 11 UzipPyPICompromised package