pypi · Malicious package advisory
Malwareprivaton-beacon-img-8f3603448690bdde-png
MAL-2026-2201
Malicious code in privaton-beacon-img-8f3603448690bdde-png (PyPI)
Details
--- _-= Per source details. Do not edit below this line.=-_ ## Source: oracle-using-macaron (be565465ab48d5cf9d07625d2414c21814f63826ea9325c35dca838e40aa24e9) This package is an install-time-executable sdist that uses setup.py paired with an opaque data.bin payload and a beacon name.
Compromised versions (14)
- 774.350.288
- 774.377.534
- 774.377.646
- 774.377.756
- 774.377.865
- 774.379.660
- 774.380.294
- 774.380.481
- 774.382.470
- 774.385.202
- 774.387.931
- 774.390.648
- 774.393.364
- 774.396.88
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.