Which versions of aiosync are malicious?

The following PyPI versions of aiosync are flagged malicious: 0.0.1, 0.0.3, 0.0.5, 0.0.7, 0.0.8. Treat any of these as compromised.

How do I remediate aiosync if I installed it?

Remove aiosync from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed aiosync — how do I know if it already compromised me?

If aiosync was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is aiosync part of a known attack campaign?

Yes — aiosync is associated with the RLMA-2024-03537, RLUA-2024-07804 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find aiosync across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for aiosync (5 malicious versions).

Malicious package

aiosyncPyPI

aiosync is a confirmed malicious PyPI package (MAL-2024-4757) that executes malicious code on install (malicious versions 0.0.1, 0.0.3, 0.0.5…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in aiosync (PyPI)

MAL-2024-4757

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall aiosync

Malicious versions

5 flagged

0.0.10.0.30.0.50.0.70.0.8

Indicators of compromise (SHA-256)

51b6ebda6dcc74dcd69c4e648589836dd70821a61290804c7bacb8c67853f4ab

a7e5dad63579751454b8a1974903e2388337637e6663a41a3b0dd177779600e5

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for aiosync (5 malicious versions).
If you installed it — respond
Remove aiosync from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If aiosync was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. aiosync on PyPI has been identified as a malicious package (versions 0.0.1, 0.0.3, 0.0.5, 0.0.7, 0.0.8 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-03537RLUA-2024-07804

Credits

ReversingLabs · finder

Detect & block this

O3 blocks aiosync-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database