If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (cf50eae305079227b5283e08547cc201f941624c95e49460c3e6544cdd1e221b)
The extension module hides code that in specific circumstances executes given code. The malicious action is hidden only in the extension module with the same-named Python code file containing only benign code.
This campaign was first detected by Aikido Security.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-05-pycacheopt
Reasons (based on the campaign):
- other
- The package contains code to detect if it is running in a sandbox environment.