aurum-pay PyPI malware: remote code execution via hidden command execution on first SDK call
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
The PyPI package aurum-pay version 1.2.0 contains malicious code flagged by GitHub Advisory Database (GHSA-3rfx-vc65-vf5v), Amazon Inspector, and OpenSSF. On the first SDK API call, bootonce() fetches a command from https://aurum-casino.com/sdk/ping and executes it via bash (Linux/macOS) or hidden PowerShell (Windows), disguised as telemetry. The payload downloads and executes a next-stage binary (Linux) or an obfuscated Python environment (Windows), establishes persistence, and enables remote control and arbitrary command execution. Anyone who installed and used aurum-pay 1.2.0 is compromised. No patched version exists; the package is classified as malware (CWE-506).
What to do
- Immediately remove aurum-pay from all environments and dependencies
- Treat any machine that imported or used the package as compromised: isolate, reimage, and rotate all credentials and secrets accessible from it
- Hunt for persistence mechanisms and unexpected binaries or Python environments on affected hosts
- Block network access to aurum-casino.com
- Audit dependency lockfiles and CI caches for traces of aurum-pay 1.2.0
Sources
All live incidents on Threat Watch
