libasync

GHSA-7vpc-7xx6-5v47

Malicious code in libasync (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: kam193 (a46929f4ba4ca97beaf5511f0be0af36c4d1e9deff65bea3821137c2c258eb9c)
During import, the code obfuscated in native extension downloads malicious remote executable and establishes persistence via registry keys. Downloaded binary seems to be used for cryptomining.

 Attacker infrastructure corresponds with the campaign 2026-07-pyqt6darktheme.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-08-libasync


Reasons (based on the campaign):


 - Downloads and executes a remote executable.


 - obfuscation


 - The package contains code to detect if it is running in a sandbox environment.


 - native-extension


 - persistence


 - cryptominer

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/d218bd7451cf256c2509cd7bab68bf0b4031c433/osv/malicious/pypi/libasync/MAL-2026-14308.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/libasync
- https://github.com/ossf/malicious-packages/blob/d218bd7451cf256c2509cd7bab68bf0b4031c433/osv/malicious/pypi/libasync/MAL-2026-14308.json
- https://tria.ge/260819-145amavbkc/behavioral1
- https://www.virustotal.com/gui/file/11d7c6bd095b62206bc5b49b6749dfc73ea21e9b5b0b268c84ef4cadd1cba278/detection
- https://www.virustotal.com/gui/file/b7e770b71209bbc615ae928de01b04aef48295bf6548fd5f6d6cfffce531c0d0/detection
- https://github.com/ossf/malicious-packages/blob/507f5ca2e4b1c67c0d2269a16df671b222d1c0e3/osv/malicious/pypi/libasync/MAL-2026-14308.json
- https://pypi.org/project/libasync/1.0.0
- https://github.com/advisories/GHSA-7vpc-7xx6-5v47

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.