VYPR

pypi · Malicious package advisory

Malware

privaton-beacon-img-8f3603448690bdde-png

MAL-2026-2201

Malicious code in privaton-beacon-img-8f3603448690bdde-png (PyPI)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: oracle-using-macaron (be565465ab48d5cf9d07625d2414c21814f63826ea9325c35dca838e40aa24e9)
This package is an install-time-executable sdist that uses setup.py paired with an opaque data.bin payload and a beacon name.

Compromised versions (14)

  • 774.350.288
  • 774.377.534
  • 774.377.646
  • 774.377.756
  • 774.377.865
  • 774.379.660
  • 774.380.294
  • 774.380.481
  • 774.382.470
  • 774.385.202
  • 774.387.931
  • 774.390.648
  • 774.393.364
  • 774.396.88

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.