netweavex typosquat malware (PyPI) — malicious clone downloads remote code on import (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-26
OpenSSF and GitHub Advisory Database (GHSA-rr8h-gqmw-34rx) report malicious code in the PyPI package netweavex, versions 1.1.0, 1.1.1 and 1.1.2. The package is a typosquatting clone of a legitimate package; on import it executes obfuscated code that downloads and runs a script from a GitHub repository (jerryjohnston91/helper-library). Analysis found the remote payload was only a placeholder, but the campaign is classified as MALICIOUS with intent such as infostealing. There are no patched versions; the package is malware and should be removed, not upgraded. Anyone who installed netweavex from PyPI is affected.
What to do
- Remove/uninstall netweavex immediately; do not use any version
- Audit environments and CI for installs of netweavex 1.1.0–1.1.2 and rebuild affected systems
- Rotate credentials and secrets on machines where the package was imported
- Verify the intended legitimate package name before installing; check for typosquatting
- Block the package name and the referenced GitHub repo in dependency firewalls/proxies
Sources
All live incidents on Threat Watch
