Which versions of assisting-threading are malicious?

The following PyPI versions of assisting-threading are flagged malicious: 0.1. Treat any of these as compromised.

How do I remediate assisting-threading if I installed it?

assisting-threading is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed assisting-threading — how do I know if it already compromised me?

If assisting-threading was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is assisting-threading part of a known attack campaign?

Yes — assisting-threading is associated with the 2024-08-old-threading-assistant campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find assisting-threading across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for assisting-threading (version 0.1).

Malicious package

assisting-threadingPyPI

Advisory published Aug 19, 2024Updated Dec 12, 2025

assisting-threading is a confirmed malicious PyPI package (MAL-2024-12209) that steals credentials and exfiltrates sensitive data (malicious version 0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in assisting-threading (PyPI)

MAL-2024-12209

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall assisting-threading

What this malware does

Infostealer exfiltrating cookies, history and passwords from the Google Chrome browser, as well as attempting to do a webcam photo. Data are sent to a Discord webhook. Malicious code is split over multiple files.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2024-08-old-threading-assistant

Reasons (based on the campaign):

infostealer
typosquatting

Malicious versions

1 flagged

0.1

Indicators of compromise (SHA-256)

6b5a7641101403d95e625db9e27ebbb1caa4bba91a70daf75f3997e10e7f78fa

33605e5f943eacd5d5ab7a4c37625226e2ef072f2fd3dac068b169d58ba1c2c9

55be697852195e9e6a2c823e40b85399a0cae73a5a61c79787a3639eebe86018

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for assisting-threading (version 0.1).
If you installed it — respond
assisting-threading is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If assisting-threading was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. assisting-threading on PyPI has been identified as a malicious package (version 0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2024-08-old-threading-assistant

References

bad-packages.kam193.eu

Credits

Kamil Mańkowski (kam193)

Detect & block this

O3 blocks assisting-threading-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database