Malicious msgpackrpc on PyPI — install/import exfiltrates host info (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
The PyPI package msgpackrpc (versions 0.0.0 and 0.1.0) is malicious code with no legitimate purpose. Installing the package or importing the module exfiltrates basic host information such as IP address and username. The package overrides the install command in setup.py so malicious code executes during pip install. Classified by OpenSSF/kam193 as PROBABLYPENTEST with limited risk, but GitHub lists it as critical malware with no patched versions. Anyone who installed or imported msgpackrpc from PyPI is affected; the legitimate msgpack-rpc-python ecosystem may be confused by the similar name. No fix exists — removal is the only remediation.
What to do
- Check environments for msgpackrpc (pip show msgpackrpc / dependency locks) and uninstall it immediately
- Audit install and CI logs for execution of its setup.py; treat affected hosts' basic info (IP, username) as exposed
- Rotate credentials if the exfiltrated data could aid follow-on attacks; review egress logs for exfil traffic
- Block the package name in internal PyPI mirrors/dependency firewalls and pin safe alternatives (e.g. msgpack-rpc-python)
Sources
All live incidents on Threat Watch
