If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (b2767ab63222f7b2b6c76334822fb6e8c8b0385df53833206362fcf52f93392a)
numprint 1.2.0 on PyPI could not be fully characterized from the available signals. No specific installer-harm fingerprint (hardcoded C2, credential path read, home-directory secret scan, install-time fetch-and-execute, dropper, backdoor, self-propagation) is concretely identified in this record. The package name resembles common numeric/printing utility names but no benign purpose is confirmed either.
Source: kam193 (ca6ff316077349c92e2d1e5d7c3683a16e6542b952d5c7fc8743efa5d4c80243)
During installation the package starts a background process executing commands provided by the attacker. The C2 communication happens through a GitHub Gist.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-numprint
Reasons (based on the campaign):
- The package overrides the install command in setup.py to execute malicious code during installation.
- The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
- rat
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://api[.]github[.]com/gists/3775fd9235aa6ef29e96eb96274a0e34 other packages →