Malicious code in zenomenallib (PyPI)
zenomenallib, a PyPI package, contained malicious code designed to exfiltrate sensitive files. The malicious payload was embedded in different locations across variants: module import, native binaries, or setup.py scripts. The package was identified and cataloged as part of the 2025-08-xenlib campaign.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on installation prevalence of zenomenallib
- Ecosystems
- Attack vectors
- Threat actor
- Affected entities
- zenomenallibPyPI package containing malicious code designed to exfiltrate sensitive files
zenomenallib is a Python package distributed via PyPI that was found to contain malicious code with clear intent to steal sensitive information. The malicious payload was implemented in multiple ways across different package variants, including execution during module import, embedding in native binaries, or injection into the setup.py installation script.
The package was identified and attributed to the 2025-08-xenlib campaign by the OpenSSF's malicious-packages project. The malicious behavior is classified as file exfiltration, indicating the code was designed to collect and transmit sensitive files from affected systems.
The incident was disclosed on 2026-07-21 via GitHub Security Advisory GHSA-v5vg-3v26-7vxh. The package has been identified and cataloged, allowing for detection and remediation by affected users.
Indicators of compromise
- Packages
- zenomenallib
Remediation
- Immediately uninstall zenomenallib from all systems where it was installed
- Audit system logs and network traffic for signs of data exfiltration
- Assume compromise of any sensitive files accessible to the Python process that imported zenomenallib
- Review and rotate credentials that may have been exposed
- Check PyPI and dependency management tools for any other suspicious packages in the 2025-08-xenlib campaign
- Monitor for similar malicious packages using OpenSSF's malicious-packages database
Sources
- GitHub Advisory GHSA-v5vg-3v26-7vxh · GitHub Advisory Database
Cite this entry
"Malicious code in zenomenallib (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-zenomenallib-pypi-18l4vb
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in afrit-name (PyPI)
Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adv2099m7 (PyPI)
Malicious code was discovered in the adv2099m7 package on PyPI. The package was identified and cataloged by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adrandom (PyPI)
The adrandom package on PyPI contained malicious code that executed spyware and information-stealing malware. It was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.
EsquelesquadPyPICompromised package - resolvedcritical
Malicious code in ziphash (PyPI)
The ziphash package on PyPI contained malicious code that downloads and executes multi-stage malware during archive-support class initialization. The malware exhibits obfuscation and remote code execution capabilities, classified as part of the 2025-11-uzip campaign.
2025 11 UzipPyPICompromised package