humbility-shared PyPI malware: install-time host data exfiltration (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub advisory GHSA-79v2-94f6-j483 (published 2026-11-11, credited to OpenSSF/kam193) flags the PyPI package humbility-shared as malicious. Versions 0.0.1 and 0.0.2 override the install command in setup.py to execute code during installation, and installing the package or importing the module exfiltrates basic host information such as IP address and username; the package has no other legitimate purpose. It is classified under the PROBABLYPENTEST category and the GENERIC-standard-pypi-install-pentest campaign, with limited risk but critical severity. No patched versions exist and no in-the-wild exploitation is documented. Anyone who installed or imported the package should treat the host as potentially compromised and remove the package.
What to do
- Remove humbility-shared from all environments and dependency trees
- Audit hosts and CI systems where it was installed or imported for signs of data exfiltration (IP, username)
- Rotate credentials accessible from affected hosts
- Block the package name in internal PyPI mirrors and dependency scanning
- Review dependency lockfiles and pip install logs for historical use
Sources
All live incidents on Threat Watch
