thisismytest

GHSA-6c5q-hvqr-r7mf

Malicious code in thisismytest (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: kam193 (a1c269bbb834081025da993697e3e2e44db4a97e16e21f4c792ed85391772fa9)
During installation, the package downloads and runs a remote executable, which is identified as a backdoor. It connects with a remote server and executes basic commands


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-03-thisismytest


Reasons (based on the campaign):


 - malware


 - Downloads and executes a remote executable.


 - backdoor

## Source: ossf-package-analysis (19f3b6e447fea825bca111985cb5f707015439b58f5d4982bb33b91a8f37a1c0)
The OpenSSF Package Analysis project identified 'thisismytest' @ 4.0.0 (pypi) as malicious.

It is considered malicious because:

- The package executes one or more commands associated with malicious behavior.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/thisismytest/MAL-2026-2017.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/thisismytest
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/thisismytest/MAL-2026-2017.json
- https://sandbox.kunai.rocks/analysis/a120c2fb-d387-4ede-beb8-72cbf8f1a219
- https://www.virustotal.com/gui/file/72603dc2a916f5e552c16c4784aea36f39fe607dfbd1523060c2299e67253549/detection
- https://www.virustotal.com/gui/file/ac4b2c52d238bc9893450e5068dfc62b87239bc60fc339e13a714ff9e5f312de/detection
- https://github.com/advisories/GHSA-6c5q-hvqr-r7mf

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.