If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (22f9a9b921e53b4755c41241969fcc8b410b09f29a63ed9c23c5a19c966b4946)
During installation, the package starts obfuscated code that downloads and runs remote executables in specific environments. In some packages in the campaign, the code only attempts to exfiltrate some basic information using DNS requests and then likely cover tracks by installing a similarly named package from private repository
Related campaigns: 2026-02-spark-audit-notify, 2026-03-geekennedy
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-02-urllib-slim
Reasons (based on the campaign):
- typosquatting
- Downloads and executes a remote executable.
- obfuscation
- dependency-confusion
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- 1r[.]vc other packages →
- i[.]1r[.]vc other packages →
URLs
- hxxps://storage[.]googleapis[.]com/py-pi/python_mac other packages →
- hxxps://storage[.]googleapis[.]com/py-pi/python_rhel other packages →
- hxxps://storage[.]googleapis[.]com/py-pi/python_win other packages →