2026-11-chromacli campaign: chromacli / supercolor-tui / rainbowcolors (PyPI) — typosquatted color libs drop Solace infostealer on Windows
Severity: critical · Patch status: no-fix-needed · Since 2026-11-08
Three PyPI packages posing as terminal-color libraries — chromacli (0.1.0–0.1.4), supercolor-tui (0.1.0–0.1.4) and rainbowcolors (0.1.0) — were published to the GitHub Advisory Database on 2026-11-08 as part of the '2026-11-chromacli' malware campaign. On Windows, calling any exported Color method (print/paint/call) triggers a hidden code path that uses PowerShell (-NoProfile -ExecutionPolicy Bypass, CREATENOWINDOW) to add Microsoft Defender exclusions for %TEMP%\SolaceRuntime and solace.exe, then downloads an unsigned solace.exe from an anonymous gofile.io share and launches it detached via subprocess.Popen. The payload is an infostealer; behavior is entirely unrelated to the packages' stated purpose. No patched versions exist — all published releases are malicious.
What to do
- Immediately remove chromacli, supercolor-tui and rainbowcolors from all environments and dependency files; do not use any version
- If installed on Windows, assume compromise: hunt for %TEMP%\SolaceRuntime\solace.exe, Defender exclusion entries for SolaceRuntime/solace.exe, and gofile.io download activity
- Rotate credentials, tokens and browser-stored secrets on affected Windows machines; reimage if infostealer execution is confirmed
- Check CI/CD and developer Windows hosts for these packages in dependency caches and lockfiles
- Pin dependencies and verify packages against advisory databases before install
Sources
All live incidents on Threat Watch
