THREATPKG
SYNC STALE

Supply-chain threat intelligence

Incident detail

criticalpypi·malware·osv

Malicious code in xforpy (PyPI)

xforpy

Risk score

92

AI summary

Indexed incident for xforpy (pypi).

Description

During import, the package starts a reverse shell


Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-anthropy

Reasons (based on the campaign):

  • The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.

Technical details

Affected versions

=0.0.1=0.0.2=0.0.3=0.0.4

Indicators

  • affected version=0.0.175%
  • affected version=0.0.275%
  • affected version=0.0.375%
  • affected version=0.0.475%

Timeline

  1. Advisory published
  2. Indexed by ThreatPkg

Related incidents