Your RSA-2048 keys break in 2030. Find every one of them before attackers do.See CBOMkit
Malicious package campaign
2025-07-0x9xnx
The 2025-07-0x9xnx campaign published 9 malicious PyPI packages. See the full package list, timeline, and how to check whether your dependency tree pulled any of them in.
Malicious packages
9
Advisories
9
Ecosystem
PyPI
First seen
2025-07-04
What to do if you depend on any of these
Every package below was published as malicious under 2025-07-0x9xnx. Treat any machine that installed one as compromised: remove the package and its lockfile entry, rotate every credential the build or runtime could reach (registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values) from a known-clean machine, and audit for unexpected outbound activity.
Because the packages share a campaign, a project that pulled in one has an elevated chance of having pulled in others. Search your lockfiles for 2025-07-0x9xnx rather than checking a single package name.