Malicious PyPI package lookuptest11 exfiltrates host info on install/import
Severity: medium · Patch status: no-fix-needed · Since 2026-11-08
GitHub Advisory Database (GHSA-c9jc-238p-3h46, published 2026-11-08) flags the PyPI package lookuptest11 as malicious. The package overrides the install command in setup.py so malicious code runs during pip install, and importing the module also exfiltrates basic host information such as IP address and username; the package has no other purpose. It is categorized as PROBABLYPENTEST under the GENERIC-standard-pypi-install-pentest campaign, with limited risk. Only version 0.0.1 is affected and no fixed version exists — the package is malware and will not be patched. Anyone who installed lookuptest11 0.0.1 may have leaked basic system details to the attacker.
What to do
- Check environments and CI for installs of lookuptest11 and remove it
- If installed, treat host IP/username as exposed and rotate any credentials that could be inferred
- Audit pip install logs and setup.py execution history for the package
- Block/flag lookuptest11 in internal PyPI mirrors and dependency scanners
- Prefer hash-pinned, scanned dependencies for install-time code execution risk
Sources
All live incidents on Threat Watch
