PyPI malware campaign 2026-11-testing1345: qap793gl4l — setup.py install hook downloads and runs remote RAT script (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub Advisory Database (GHSA-rm58-9wp3-cwmv, published 2026-11-13, credited to OpenSSF/kam193) flags the PyPI package qap793gl4l version 0.1.1 as malicious, part of a campaign tracked as 2026-11-testing1345. The package overrides the install command in setup.py so malicious code executes during pip installation, then downloads and runs a remote script to deploy a RAT. Analysts noted the remote GitHub repository hosting the payload did not yet contain the malicious code at analysis time. Anyone who installed qap793gl4l 0.1.1 is affected; there are no fixed versions — the package is malware and should be removed, not upgraded.
What to do
- Check environments and lockfiles for qap793gl4l and remove it; version 0.1.1 is the affected release
- Treat any machine where it was installed as compromised: isolate, reimage, rotate credentials and secrets
- Hunt for signs of RAT activity and outbound connections to the attacker's payload host
- Block the package and associated indicators in artifact/proxy controls; audit for other packages from the same campaign
Sources
All live incidents on Threat Watch
