PyPI typosquat malware: changes-lxc-wrapper & zagents-framework exfiltrate host info on install/import (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-26
Two malicious PyPI packages, changes-lxc-wrapper (versions 0.0.0, 0.1.0) and zagents-framework (versions 6.25.30.10b5, 99.25.30.10b5), were published to the GitHub Advisory Database on 2026-10-26 as embedded malware (CWE-506). Installing either package or importing the module exfiltrates basic host information such as IP address and username; the packages have no other purpose. Both override the install command in setup.py to execute malicious code during installation, meaning even a pip install without importing triggers the exfiltration. Classified under the GENERIC-standard-pypi-install-pentest campaign as PROBABLYPENTEST with limited risk. No patched versions exist; the packages should be treated as malware and removed.
What to do
- Check environments and dependency lockfiles for changes-lxc-wrapper or zagents-framework and uninstall them immediately
- Treat any host where they were installed or imported as having leaked IP/username data; review for follow-on targeting
- Rotate credentials if the affected host is shared or CI infrastructure
- Block the package names in PyPI proxies/mirrors and internal artifact repositories
- Audit setup.py-based installs and prefer hash-pinned dependencies from trusted sources
Sources
All live incidents on Threat Watch
