gatepay-sdk-python (PyPI): malicious package exfiltrates host info on install/import (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-15
GitHub published advisory GHSA-rp2f-46j6-grv4 on 2026-11-15 flagging the PyPI package gatepay-sdk-python as malware. Version 99.99.1 overrides the install command in setup.py to execute malicious code during installation, and importing the module exfiltrates basic host information such as IP address and username; the package has no legitimate purpose. Classified under the GENERIC-standard-pypi-install-pentest campaign as PROBABLYPENTEST with limited risk, but rated critical with no patched versions — the only remediation is removal. Credit to OpenSSF malicious-packages and kam193's bad-packages database. Any environment that installed or imported the package is affected.
What to do
- Search environments and dependency lockfiles for gatepay-sdk-python and remove/uninstall it immediately
- Treat any host where it was installed or imported as potentially compromised; rotate credentials and review for exfiltrated data (IP, username)
- Block the package name in internal PyPI mirrors and CI dependency resolution
- Review pip install logs and setup.py execution history for signs of the malicious install hook
Sources
All live incidents on Threat Watch
