starlette-healthchecks

Details

**Severity:** Critical

**Affected versions:** `= 1.3.1`

## Source: kam193 (13c2438df5dfe3675f8861c03c803a273747135af8a70fc916235ad64d6cd22f)
The package appears to be a typosquatting research attempt. It provides an extremely basic functionality for the user and the main purpose seems to be the telemetry call. Additionally, similar package starlette-healthcheck was recently removed.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-09-starlette-healthcheck


Reasons (based on the campaign):


 - action-hidden-in-lib-usage


 - typosquatting

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/1b9f031b65c0c7f49c13fdbadbedf5b95af9ce9c/osv/malicious/pypi/starlette-healthchecks/MAL-2026-16356.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/starlette-healthchecks
- https://github.com/ossf/malicious-packages/blob/1b9f031b65c0c7f49c13fdbadbedf5b95af9ce9c/osv/malicious/pypi/starlette-healthchecks/MAL-2026-16356.json
- https://github.com/ossf/malicious-packages/blob/7ae960133637ba13697c4fbec21ce9558bc7ce7b/osv/malicious/pypi/starlette-healthchecks/MAL-2026-16356.json
- https://github.com/ossf/malicious-packages/blob/a353b26f444959f921d20700f1f1d31bfa61715d/osv/malicious/pypi/starlette-healthchecks/MAL-2026-16356.json
- https://pypi.org/project/starlette-healthchecks/1.3.1
- https://pypi.org/project/starlette-healthchecks/1.3.2
- https://github.com/advisories/GHSA-6g46-rqp7-42mp

Compromised versions (1)

• = 1.3.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.