stdid-nyxprobe (PyPI): malicious package exfiltrates host info on install/import (no CVE)
Severity: high · Patch status: no-fix-needed · Since 2026-10-30
GitHub published a malware advisory (GHSA-9g52-4q2j-2cg3) for the PyPI package stdid-nyxprobe, versions 0.0.1 and 0.0.2. The package overrides the install command in setup.py so malicious code runs during pip install, and importing the module also exfiltrates basic host information such as IP address and username; the package has no other purpose. It is categorized as PROBABLYPENTEST with limited risk, part of the GENERIC-standard-pypi-install-pentest campaign, and credited to OpenSSF/kam193. No patched versions exist — the package is malware and should be removed, not upgraded. Anyone who installed it should treat the host as having leaked basic system info and audit for further compromise.
What to do
- Remove stdid-nyxprobe from all environments and dependency files; block the package name in your artifact proxy/firewall
- Check install and CI logs for any pip installs of stdid-nyxprobe versions 0.0.1/0.0.2
- On affected hosts, rotate credentials and review what data (IP, username) may have been exfiltrated
- Audit dependencies for typosquatting and pin packages from trusted sources
Sources
All live incidents on Threat Watch
