govpkg

GHSA-f88m-xf6h-ph28

Malicious code in govpkg (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.1.0`

## Source: kam193 (736ef874636ee77d0a5007dea41ad6329e0d5523bfeb5254930985f451a6f6f6)
When using the provided functionality, the package silently downloads a malicious executable and ensures its persistence disguised as a system service. The binary connects with telegra[.]ph.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-07-govpkg


Reasons (based on the campaign):


 - Downloads and executes a remote executable.


 - action-hidden-in-lib-usage


 - persistence

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/96845bb6b7c635d6860f7de9103fbaec06360beb/osv/malicious/pypi/govpkg/MAL-2026-10770.json))

**References:**
- https://app.any.run/tasks/0fc6b9f4-8052-435b-9c0a-3d48dfe79018
- https://bad-packages.kam193.eu/pypi/package/govpkg
- https://github.com/ossf/malicious-packages/blob/96845bb6b7c635d6860f7de9103fbaec06360beb/osv/malicious/pypi/govpkg/MAL-2026-10770.json
- https://www.virustotal.com/gui/file/7bd6824cbcb603a4cc79728985557a74c876db2d1e8a71e2120d79e3e507525a/detection
- https://github.com/ossf/malicious-packages/blob/0c11afc7acc22b6ae6dcd1d9e05bf37368cc773e/osv/malicious/pypi/govpkg/MAL-2026-10770.json
- https://pypi.org/project/govpkg/0.1.0
- https://github.com/advisories/GHSA-f88m-xf6h-ph28

Compromised versions (1)

= 0.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.