demo-pingtest-xyz (PyPI): malicious package exfiltrates host info on install/import (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-14
GitHub's advisory database (crediting OpenSSF's malicious-packages project and kam193's bad-packages database) flagged the PyPI package demo-pingtest-xyz as malware. Version 0.0.1 overrides the install command in setup.py so malicious code runs during pip install, and importing the module also triggers exfiltration of basic host information such as IP address and username; the package has no legitimate purpose. It is categorised as PROBABLYPENTEST with limited risk, but the advisory rates it critical. No patched versions exist — the package is malware and should simply be removed. Anyone who installed it or imported the module should treat host data as potentially exposed.
What to do
- Search environments for demo-pingtest-xyz and uninstall it; block the package name in internal PyPI mirrors/proxies
- If installed or imported, investigate what host data (IP, username) may have been exfiltrated and review outbound connections from affected machines
- Rotate credentials used on affected hosts if exfiltration is confirmed or suspected
- Audit pip install logs and CI pipelines for use of the package
- Enforce dependency allowlists/scanning (e.g. OSV/GHSA checks) for Python dependencies
Sources
All live incidents on Threat Watch
