hxq-misc-utils-0379

GHSA-jv73-jhgv-7964

Malicious code in hxq-misc-utils-0379 (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 2026.310.1`

## Source: oracle-using-macaron (1e22088fbe314143f0c3eb971a645a125a9a32753184ceb5abd533ac7e60da69)
This package includes an encrypted payload file that appears to be used to deliver code or resources to other packages. The payload changes between releases, and because its contents cannot be inspected, it lacks transparency and violates PyPI’s publishing rules.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/hxq-misc-utils-0379/MAL-2026-1453.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/hxq-misc-utils-0379/MAL-2026-1453.json
- https://github.com/advisories/GHSA-jv73-jhgv-7964

Compromised versions (1)

= 2026.310.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.