playwrightr

GHSA-j66f-53jc-vmph

Malicious code in playwrightr (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (1e165b925f82629524e611c81597c32a171df7cec246dc73f268d8192ccbe2c5)
setup.py registers a CustomInstallCommand that runs automatically on `pip install` under Windows. It uses WinHTTP via ctypes to fetch a binary from florinn.dev:65534/ins.exe, writes it to %TEMP%\runner.exe, deletes the NTFS Zone.Identifier alternate data stream to bypass Mark-of-the-Web / SmartScreen warnings, and launches the executable hidden via CreateProcessW with CREATE_NO_WINDOW. The package name is a one-character edit of the widely used 'playwright' PyPI package, and its only shipped functionality is an unrelated `change_theme()` stub referencing pyqt6darktheme, confirming the package exists solely to deliver the dropper. Installer harm: on `pip install playwrightr` on Windows, an attacker-controlled executable runs on the installer's machine with the installing user's privileges and with anti-detection measures actively engaged.

## Source: kam193 (0e8219b6ae0da7b60916526489bcd2f364db415113ff878ea52050127dfa37b9)
Package downloads and runs a remote executable, which was found to downloads further exes and starting coine mining


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-07-pyqt6darktheme


Reasons (based on the campaign):


 - cryptominer


 - Downloads and executes a remote executable.


 - malware


 - The package overrides the install command in setup.py to execute malicious code during installation.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/playwrightr/MAL-2026-10020.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/playwrightr
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/playwrightr/MAL-2026-10020.json
- https://pypi.org/project/playwrightr/1.0.1
- https://tria.ge/260708-eg92psat5t
- https://www.virustotal.com/gui/file/1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6/detection
- https://www.virustotal.com/gui/file/93be0d295af944feef85c8694f88a50b660f106a5ed18300252a72d8b43b69de/detection
- https://github.com/advisories/GHSA-j66f-53jc-vmph

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.