Which versions of aseity are malicious?

The following PyPI versions of aseity are flagged malicious: 0.1.0. Treat any of these as compromised.

How do I remediate aseity if I installed it?

aseity is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed aseity — how do I know if it already compromised me?

If aseity was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is aseity part of a known attack campaign?

Yes — aseity is associated with the 2026-09-donutautosellsrc, IN-MAL-2026-020578 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find aseity across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for aseity (version 0.1.0).

Part of a larger attack: 2026-09-donutautosellsrc published 9 malicious packages. See the full campaign →

Malicious package

aseityPyPI

Advisory published Sep 27, 2026Updated Oct 25, 2026

aseity is a confirmed malicious PyPI package (MAL-2026-17200) that steals credentials and exfiltrates sensitive data (malicious version 0.1.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in aseity (PyPI)

MAL-2026-17200

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall aseity

What this malware does

setup.py invokes aseity.compat._ensure_compat, which base64+zlib-decodes the DATA constant shipped in aseity/_shimdata.py and passes the resulting Python source to exec(), so the payload runs automatically on pip install. aseity/init.py runs the same routine, so a bare import aseity also triggers it. The decoded stage-1 performs VM and debugger checks, downloads https://thisisafalsepositive.st/cdn/v2/9f4e7a2c1b8d.png (a PNG carrying a ZIP inside its chunks), extracts a bundled python.exe and AppHost/main.py to a temp directory, and launches subprocess.Popen([py, entry, '-u', _USER, '--env', 'EXE', '--tag', 'PyPi']) with Windows creationflags DETACHED_PROCESS | CREATE_NO_WINDOW (0x00000008 | 0x08000000). A hardcoded per-victim UUID (_USER='e00db386-ab62-4dc1-91fd-21ef9ff3e6ef') is passed to the second stage. The domain thisisafalsepositive.st is not associated with any declared publisher, the delivered bytes are opaque, the payload is hidden as an encoded blob in a data-named module, and the launcher deliberately detaches with no visible window — the shape of a supply-chain dropper deploying a persistent second-stage implant on the installer's host.

During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in the Polygon blockchain.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-donutautosellsrc

Reasons (based on the campaign):

infostealer
Downloads and executes a remote executable.
obfuscation
malware
native-extension
steganography
c2-in-blockchain
The package contains code to detect if it is running in a sandbox environment.

Malicious versions

1 flagged

0.1.0

Indicators of compromise (SHA-256)

cf65ea5c0fe1eeef9f47a75d65e291a715094076714694247ad03714eabc53ca

d65d0df302f9fdd618d08a8bc095702f5b6594712ba82205c758c710fee9006e

16b7922f1908a09623723d954ad42997eef7a97144e450cb23f0898b2d459f0d

e538e382e4de3665cda55e52e7a783a847da9726f8e3f0e5ee33a5ec7f87b548

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for aseity (version 0.1.0).
If you installed it — respond
aseity is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If aseity was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. aseity on PyPI has been identified as a malicious package (version 0.1.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-09-donutautosellsrcIN-MAL-2026-020578

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks aseity-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database