PyPI: malicious package journey-teste-shellhello spawns reverse shell during installation (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-23
The PyPI package journey-teste-shellhello version 0.2.0 was identified as malicious: it overrides the install command in setup.py to execute code during installation, and in specific environments starts a reverse shell, giving an attacker arbitrary command execution on the victim machine. The GitHub advisory (GHSA-r42r-j8h5-x7r3), published 2026-10-23 and credited to OpenSSF's malicious-packages database, categorizes it as MALICIOUS under campaign 2026-10-journey-test-helloshell and marks it a targeted attack (CWE-506, embedded malicious code). Anyone who pip-installed version 0.2.0 is affected. There are no patched versions; the package is malware and should be removed, not upgraded.
What to do
- Check pip/requirements logs and environments for any install of journey-teste-shellhello==0.2.0 and remove it
- If installed, treat the machine as compromised: isolate, hunt for reverse-shell/network callbacks, rotate credentials, and rebuild from a clean image
- Block the package name in internal PyPI mirrors/proxies and alert on attempts to install it
- Review CI/CD and developer workstations for signs of execution during pip install phases
Sources
All live incidents on Threat Watch
