privaton-beacon-img-8f3603448690bdde-png

GHSA-p373-j6mw-pvf4

Malicious code in privaton-beacon-img-8f3603448690bdde-png (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 774.350.288`

## Source: oracle-using-macaron (be565465ab48d5cf9d07625d2414c21814f63826ea9325c35dca838e40aa24e9)
This package is an install-time-executable sdist that uses setup.py paired with an opaque data.bin payload and a beacon name.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/privaton-beacon-img-8f3603448690bdde-png/MAL-2026-2201.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/privaton-beacon-img-8f3603448690bdde-png/MAL-2026-2201.json
- https://github.com/advisories/GHSA-p373-j6mw-pvf4

Compromised versions (1)

= 774.350.288

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.