2026-10-numprint: PyPI package numprint — malicious install-time RAT executing attacker commands via GitHub Gist C2
Severity: critical · Patch status: no-fix-needed · Since 2026-10-27
The PyPI package numprint version 1.2.0 was identified as malware in the 2026-10-numprint campaign. The package overrides the install command in setup.py to execute malicious code during installation, starting a background process that executes attacker-provided commands. C2 communication occurs through a GitHub Gist. The package contains RAT-like functionality to run remote commands (likely a limited set) on victims' machines. Anyone who installed numprint 1.2.0 from PyPI is affected. There are no patched versions; the package is malware and should not be used. Identified by kam193 and catalogued via OpenSSF malicious-packages (MAL-2026-18343) and GitHub Advisory GHSA-g9fj-q87h-6h4c.
What to do
- Immediately uninstall numprint 1.2.0 from all environments
- Audit systems where numprint was installed for compromise, persistence, and C2 traffic to GitHub Gist endpoints
- Rotate credentials and secrets on affected machines
- Block/remove the package from internal PyPI mirrors and dependency allowlists
- Review CI/CD and developer workstations for install-time execution of this package
Sources
All live incidents on Threat Watch
