2026-11-old-pyuserfox campaign: pyuserox, pyuserfox, twitch-stream-py PyPI packages download and execute remote malicious code on import
Severity: critical · Patch status: no-fix-needed · Since 2026-11-08
OpenSSF and GitHub Advisory Database published malware advisories on 2026-11-08 for three malicious PyPI packages tied to campaigns originally discovered by Threx-code. pyuserox 0.0.2 and pyuserfox 0.0.2 silently download and execute a remote malicious script during import. twitch-stream-py, a clone of a legitimate package with injected code, uses obfuscation and hides the malicious action in library usage across versions 1.0.2rc0 through 1.1.2. The campaigns are categorized as MALICIOUS (infostealer-like intent). During analysis the remote payloads were no longer accessible, so full impact is unknown. No patched versions exist; the packages should be treated as compromised and removed.
What to do
- Immediately uninstall pyuserox, pyuserfox, and twitch-stream-py from all environments and block them in dependency allowlists and CI
- Audit lockfiles and dependency trees for these packages and any versions of twitch-stream-py
- If installed, treat hosts as compromised: rotate credentials, secrets, and tokens accessible to those environments, and review for infostealer artifacts
- Rebuild affected environments from trusted images and re-verify dependencies against OpenSSF malicious-packages data
Sources
All live incidents on Threat Watch
