highSupply Chain

PyPI Malicious Package Campaign

First seen Jul 3, 2026 · Updated Jul 3, 2026

Supply ChainPythonDeveloper Tools

Coordinated campaign publishing typosquatted Python packages to steal environment variables, SSH keys, and cloud credentials from developer workstations and CI/CD pipelines.

Affected Systems

Python developers, CI/CD pulling from PyPI, AWS/GCP/Azure credentials in env vars

Indicators of Compromise

  • Typosquatted package names
  • Post-install encoded payloads
  • .env and .ssh exfiltration
  • DNS-based data exfiltration

Remediation Steps

  1. 1

    Package Allowlisting

    Implement allowlists in CI/CD pipelines

  2. 2

    Hash Verification

    Use pip --require-hashes for all dependencies

  3. 3

    Secret Scanning

    Deploy scanning for credentials in env vars and repos

  4. 4

    DNS Monitoring

    Watch for unusual queries from build servers

Industries Most Exposed

TechnologySoftware Development

Respond to this threat

Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.

View response playbook →Browse more threats