py2ops

Details

**Severity:** Critical

**Affected versions:** `= 2.2`

The package installs a console command named python2 (pyops.cli:main), so it runs when someone types python2. On first run _register() in cli.py POSTs the hostname and OS to a space-z.ai server and keeps the returned apiKey in ~/.python2/config.json. Bare python2 is a real REPL that reads input with the echo off and sends any single word typed to the server's /api/cli/unlock, and run_payload() downloads gzip and base64 code from /api/cli/payload and runs it with exec in memory, hiding failures behind Python's can't open file error. Comments in the file call this the cover. I did not see what the served code does. I read 2.2 and did not run it.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/181a0efb92858846e600372fdbe924ccc71c4593/osv/malicious/pypi/py2ops/MAL-2026-17807.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/181a0efb92858846e600372fdbe924ccc71c4593/osv/malicious/pypi/py2ops/MAL-2026-17807.json
- https://github.com/advisories/GHSA-hfr2-qh7r-7xrr

Compromised versions (1)

• = 2.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.