Skip to content
OpenAdvisories
Malicious MAL-2024-10023

evil-package

PyPI package · versions 0.0.3, 0.0.1, 0.0.2

Reported Jul 24, 2024 · Updated Mar 19, 2026

If this package is installed

Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.

Details

Source: kam193 (a6fe9e1f81afbcfb5f8f0d260af0434649c77b11d353d3264c7022e763767d43)
---

Category: PENTEST - Packages with high confidence of being created for a pentest.

Campaign: TEST-PACKAGES

Reasons (based on the campaign):