multyproccess

Details

**Severity:** Critical

**Affected versions:** `= 2.32.3`

## Source: kam193 (93a751dcfb2e5ac6058cbd62220d237288d3ceb4d8fe152b7ef7babb645df660)
During installation, package executes an infostealer that e.g. exfiltrates browsers and crypto wallets data, establishes persistence, monitors clipboard.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-08-multyproccess


Reasons (based on the campaign):


 - typosquatting


 - infostealer


 - exfiltration-crypto


 - exfiltration-browser-data


 - clones-real-package


 - The package overrides the install command in setup.py to execute malicious code during installation.


 - The package contains code to detect if it is running in a sandbox environment.


 - obfuscation


 - persistence

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/c04e75e38121768f82fef0495de77b68b7054d7c/osv/malicious/pypi/multyproccess/MAL-2026-14401.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/multyproccess
- https://github.com/ossf/malicious-packages/blob/c04e75e38121768f82fef0495de77b68b7054d7c/osv/malicious/pypi/multyproccess/MAL-2026-14401.json
- https://github.com/ossf/malicious-packages/blob/72e5d8219b286d7332c4ad2364b87986138cf34c/osv/malicious/pypi/multyproccess/MAL-2026-14401.json
- https://pypi.org/project/multyproccess/2.32.3
- https://pypi.org/project/multyproccess/2.32.4
- https://pypi.org/project/multyproccess/2.32.5
- https://pypi.org/project/multyproccess/2.32.6
- https://github.com/advisories/GHSA-32gv-h6qj-hjm8

Compromised versions (1)

• = 2.32.3

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.