If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (83ccb335aa01c8a31acb208aa2f1c2654ab010f9f3cc29fd2f1e6f60a44113f8)
pyprig impersonates pydantic: the package name, description ('Data validation using Python type hints'), and README are near-verbatim clones of pydantic, and pyproject.toml lists pydantic's real maintainers (Samuel Colvin, Eric Jolibois, Hasan Ramezani, David Hewitt, et al.) as authors. The top-level pyprig/__init__.py unconditionally calls get_help() from pyprig/help.py on every import. get_help() downloads https://github.com/PyPrig/pyprig-help/archive/refs/heads/main.zip from the mutable main branch with no commit pin and no hash or signature verification, then extracts the archive into the installed package tree at <site-packages>/pyprig/help/ via archive.extractall followed by shutil.copytree into HELP_DIR = PACKAGE_DIR / 'help'. Because the files land inside the Python package directory, whoever controls the PyPrig/pyprig-help repository can replace them at any time to stage Python files that are then importable from within the package, giving arbitrary code execution on any machine that imports pyprig after the swap.
Source: kam193 (11f4beddcb42e2348d31d2ef0605d72198a28e796467c8afbac5c5c30d870315)
Clone of a legitimate Pydantic package with the added downloading of a remote code. The remote code is delivered from the GitHub repository and unpacked as a new module and then called during initialization of any models (runner injected into cloned Pydantic code). During analysis, the remote code was just a placeholder.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-pyprig
Reasons (based on the campaign):
- Downloads and executes a remote malicious script.
- clones-real-package