pygame-renderkit

Details

**Severity:** Critical

**Affected versions:** `= 1.2.0`

## Source: kam193 (5856daeb3070a9b2a6ffc42d8999ff49c63706ccb27ee683e5fcc4ff175f78f9)
During installation, the package attempts to exfiltrate sensitive environment variables and files, establish persistence and open reverse shell.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-08-pygame-renderkit


Reasons (based on the campaign):


 - persistence


 - The package overrides the install command in setup.py to execute malicious code during installation.


 - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.


 - files-exfiltration


 - exfiltration-env-variables

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/f686f707b41fdea6c49bfdc86ab0f36b03099405/osv/malicious/pypi/pygame-renderkit/MAL-2026-14587.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/pygame-renderkit
- https://github.com/ossf/malicious-packages/blob/f686f707b41fdea6c49bfdc86ab0f36b03099405/osv/malicious/pypi/pygame-renderkit/MAL-2026-14587.json
- https://github.com/ossf/malicious-packages/blob/5203541202891aa13928fdb1ce96f5d52556503b/osv/malicious/pypi/pygame-renderkit/MAL-2026-14587.json
- https://pypi.org/project/pygame-renderkit/1.2.0
- https://github.com/ossf/malicious-packages/blob/c40f765296358a44eb5f2d931a66d5d58d41caf7/osv/malicious/pypi/pygame-renderkit/MAL-2026-14587.json
- https://github.com/advisories/GHSA-53q9-ghm7-r8g3

Compromised versions (1)

• = 1.2.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.