auclean

Details

**Severity:** Critical

**Affected versions:** `= 0.4.2`

## Source: kam193 (b337040219fb9c972fb5437f3546e662ba42d292657ad100b875c6224f152e71)
During installation, the package executes embeded malicious executable. It then fingerprints the environment and network, looks for specific files, attempts to collect cloud credentials, and eventually attempts to exfiltrate collected information.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-09-auclean


Reasons (based on the campaign):


 - malware


 - network-scan


 - files-exfiltration


 - The package overrides the install command in setup.py to execute malicious code during installation.


 - exfiltration-credentials


 - exfiltration-cloud-tokens


 - targetted-attack

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/7bea99dd2e51b021b3e85ae4ef95d2f3a8e954a5/osv/malicious/pypi/auclean/MAL-2026-16410.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/auclean
- https://github.com/ossf/malicious-packages/blob/7bea99dd2e51b021b3e85ae4ef95d2f3a8e954a5/osv/malicious/pypi/auclean/MAL-2026-16410.json
- https://tria.ge/260922-zncd8sw14q/behavioral1
- https://www.virustotal.com/gui/file/2a2212676b699cdd44b480d8ac44a4ea0e9887c8ea43b8a531d4ac7279ac2526/detection
- https://github.com/ossf/malicious-packages/blob/76398e59725721b4b1829aff3872e1f7fe84dabb/osv/malicious/pypi/auclean/MAL-2026-16410.json
- https://tria.ge/260922-zve4pssdmf/behavioral1
- https://github.com/ossf/malicious-packages/blob/a353b26f444959f921d20700f1f1d31bfa61715d/osv/malicious/pypi/auclean/MAL-2026-16410.json
- https://pypi.org/project/auclean/0.4.2

Compromised versions (1)

• = 0.4.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.