Which versions of atlas-internal are malicious?

The following PyPI versions of atlas-internal are flagged malicious: 1.8.1. Treat any of these as compromised.

How do I remediate atlas-internal if I installed it?

atlas-internal is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed atlas-internal — how do I know if it already compromised me?

If atlas-internal was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is atlas-internal part of a known attack campaign?

Yes — atlas-internal is associated with the IN-MAL-2026-017105, GENERIC-standard-pypi-install-pentest campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find atlas-internal across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for atlas-internal (version 1.8.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging atlas-internal across your stack and pipelines.

Malicious package

atlas-internalPyPI

atlas-internal is a confirmed malicious PyPI package (MAL-2026-13619) that steals credentials and exfiltrates sensitive data (malicious version 1.8.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in atlas-internal (PyPI)

MAL-2026-13619

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall atlas-internal

What this malware does

setup.py overrides the egg_info command to execute automatically during pip install. The overridden command collects the installer's hostname, current working directory, and OS username, URL-encodes them, and sends them via an HTTP GET request to a hardcoded Interactsh out-of-band callback subdomain at fpvbsifkklbmklusmxby2405wa7x7x5bf.oast.fun. This fires on default install without user interaction and leaks installer host identifiers to an attacker-controlled OOB server, consistent with a dependency-confusion reconnaissance beacon.

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: GENERIC-standard-pypi-install-pentest

Reasons (based on the campaign):

The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
The package overrides the install command in setup.py to execute malicious code during installation.

Malicious versions

1 flagged

1.8.1

Indicators of compromise (SHA-256)

cdd4a17504623add1ff4f374ea9c2283d1eb5a863265e012592142b169cd9d90

e41b6a5ae4af745c6bc5b2514fa7202d95242ef71a60a57f130524ccfddc99da

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for atlas-internal (version 1.8.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging atlas-internal across your stack and pipelines.
If you installed it — respond
atlas-internal is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If atlas-internal was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks atlas-internal before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. atlas-internal on PyPI has been identified as a malicious package (version 1.8.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-017105GENERIC-standard-pypi-install-pentest

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks atlas-internal-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database