Malicious PyPI package xrfdc exfiltrates host info on install/import (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-14
GitHub Advisory Database published GHSA-fmq9-qj28-89vh on 2026-11-14 flagging the PyPI package xrfdc as malicious. Installing the package or importing the module exfiltrates basic host information (e.g., IP address, username), and the package has no legitimate purpose. The malicious code runs during installation because setup.py overrides the install command, so even a pip install without importing is enough to trigger exfiltration. Affected versions are 0.0.0 and 2.0, with no patched versions available. The advisory categorises it as PROBABLYPENTEST with limited risk, credited to OpenSSF's malicious-packages database and kam193's bad-packages research. Any developer or CI environment that installed xrfdc from PyPI is affected.
What to do
- Remove xrfdc from all environments and dependency files; do not install any version
- Audit build logs and hosts where xrfdc was installed or imported for signs of data exfiltration (outbound connections, leaked IP/username data)
- Rotate credentials and secrets that may have been present on affected machines or CI runners
- Check dependency lockfiles and SBOMs for historical use of xrfdc
- Block the package name in internal PyPI mirrors/proxies
Sources
All live incidents on Threat Watch
