risk-utilities

GHSA-xvf9-mj7m-x5g3

Malicious code in risk-utilities (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 6.0.0`

## Source: kam193 (22f9a9b921e53b4755c41241969fcc8b410b09f29a63ed9c23c5a19c966b4946)
During installation, the package starts obfuscated code that downloads and runs remote executables in specific environments. In some packages in the campaign, the code only attempts to exfiltrate some basic information using DNS requests and then likely cover tracks by installing a similarly named package from private repository

Related campaigns: 2026-02-spark-audit-notify, 2026-03-geekennedy


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-02-urllib-slim


Reasons (based on the campaign):


 - typosquatting


 - Downloads and executes a remote executable.


 - obfuscation


 - dependency-confusion

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/risk-utilities/MAL-2026-1223.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/risk-utilities
- https://github.com/GCLNS
- https://github.com/geekennedy
- https://github.com/loudpage5125
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/risk-utilities/MAL-2026-1223.json
- https://www.virustotal.com/gui/file/d6029cce705b3842042106efb737c8b14eb736fdbfb8d0d03c3dfbc8d6c207a5?nocache=1
- https://github.com/advisories/GHSA-xvf9-mj7m-x5g3

Compromised versions (1)

= 6.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.