PyPI: typosquatted packages 1h1 and aanthropic download and execute malware during install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-22
Two typosquatted PyPI packages, 1h1 and aanthropic (version 1.0.0), were published to the GitHub Advisory Database on 2026-10-22 as part of the '2026-10-semvver' malware campaign. Both packages download and execute a remote executable during installation, with infostealer-style malicious intent (CWE-506). The same malware binary hash appears in both advisories' VirusTotal references. Anyone who pip-installed either package — likely developers mistyping 'anthropic' or similar names — has executed malware on their machine. There are no patched versions; the packages are simply malicious and should never be used. Removal from PyPI and advisory publication are the mitigations.
What to do
- Check pip logs, lockfiles, and CI history for any install of 1h1 or aanthropic 1.0.0 and treat any machine that installed them as compromised
- Rebuild affected machines/CI runners from trusted images and rotate all credentials, tokens, and secrets accessible from them
- Audit environments for the malware binary hash e6d96b5500b232bea67f6f9046cfbc22d29a515c42d2af9523a15ebe8a7c4ab7
- Pin dependencies and verify package names carefully to avoid typosquatting; use hash-pinned requirements
- Enable PyPI/GitHub Dependabot malware alerts and block these package names in dependency firewalls
Sources
All live incidents on Threat Watch
