If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
twitchstream/getchat.py is a modified copy of the sounddevice library. Its query_hostapis() function, which other functions in the module call, decodes a base32-hidden URL, downloads a Python script from it to %USERPROFILE%\.steam\script.py, adds a value named "Windows_Update" under HKCU\Software\Microsoft\Windows\CurrentVersion\Run that starts the script with pythonw.exe at every logon, and runs the script. Version examined: 1.1.2; sdist SHA-256 a3e89f18772d5e6ef67a57c27d4b6e84b7ffc6c2dc49c380b6a3a94d4ce31226.
---
_-= Per source details. Do not edit below this line.=-_
Source: kam193 (bbb2267e685c94eee0456daa9e10960e5cacd1e010a93ecd34c9cd5effe07c9c)
Clone of a legitimate package with injected code that downloads and executes a script from a remote location. During analysis, the remote code was no longer accessible. The campaign was originally discovered by Threx-code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-old-twitch-stream-py
Reasons (based on the campaign):
- obfuscation
- Downloads and executes a remote malicious script.
- clones-real-package
- action-hidden-in-lib-usage
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://darkseagreenthornygraduate[.]wekimi5565[.]repl[.]co/script[.]py other packages →