privacypass-py PyPI malware: credential-stealing beacon exfiltrates env secrets on install and import (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-01
The PyPI package privacypass-py, version 0.1.101, posing as 'Privacy Pass client primitives', contains no cryptographic functionality and is purely a data-exfiltration beacon. Its setup.py runs a report() routine during build/install collecting hostname, username, cwd, argv, parent process command line, and credential-matching environment variables (AWS, GITHUB, PIP, etc.), POSTing to http://85.190.112.236:8881/b/<nonce over plain HTTP. On import, init.py repeats the beacon with expanded prefixes (CLOUDFLARE, SUPERTOKENS, HOME, USER, PATH) and a substring filter (KEY/SECRET/TOKEN/PASS/CRED/PRIVATE/SEED/MNEMONIC/SIGNATURE/COOKIE/SESSION/AUTH), sending to /f/<nonce. The import-time path fires outside pip build isolation. No fixed version exists; the package should be removed and exposed credentials rotated.
What to do
- Remove privacypass-py from all environments and dependency trees
- Rotate any credentials whose env vars match the targeted prefixes (AWS_, GITHUB_, PIP_, CLOUDFLARE_, etc.) and any secrets matching KEY/SECRET/TOKEN/PASS/CRED/PRIVATE/SEED/MNEMONIC/SIGNATURE/COOKIE/SESSION/AUTH patterns
- Block outbound traffic to 85.190.112.236:8881 and hunt logs for connections to it
- Audit CI/CD and developer machines for installs/imports of the package and review pip logs for exposure
- Pin dependencies and scan for typosquatting lookalikes of privacy-pass packages
Sources
All live incidents on Threat Watch
