Malicious PyPI packages twitter-request-diagnostics and test-01-rafamarrara-learning-dc backdoor web apps
Severity: critical · Patch status: no-fix-needed · Since 2026-10-30
Two malicious PyPI packages, twitter-request-diagnostics and test-01-rafamarrara-learning-dc (both version 1.0.0), were published and documented by OpenSSF malicious-packages and the GitHub Advisory Database on 2026-10-30 as part of campaign 2026-10-test-01-rafamarrara-learning-dc. Both pose as web middleware adding a diagnostic endpoint but actually exfiltrate environment variables (stealing secrets such as API keys and credentials) and contain hidden backdoor functionality allowing remote execution of attacker-sent commands. Any developer or application that installs either package is exposed to credential theft and remote code execution. No patched versions exist; the packages are malware and must be removed entirely rather than upgraded.
What to do
- Immediately remove twitter-request-diagnostics and test-01-rafamarrara-learning-dc from all environments and dependency manifests
- Rotate all secrets, API keys, and credentials that could have been exposed via environment variables on affected systems
- Audit systems where the packages ran for signs of command execution or unauthorized access
- Check CI/CD pipelines and lockfiles for the packages and block them in dependency scanning
- Report any installs to your security team and monitor for related campaign packages
Sources
All live incidents on Threat Watch
