Which versions of claudeopuseni are malicious?

The following PyPI versions of claudeopuseni are flagged malicious: 0.1.0, 0.1.1. Treat any of these as compromised.

How do I remediate claudeopuseni if I installed it?

claudeopuseni is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed claudeopuseni — how do I know if it already compromised me?

If claudeopuseni was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is claudeopuseni part of a known attack campaign?

Yes — claudeopuseni is associated with the 2026-09-donutautosellsrc, IN-MAL-2026-021760, IN-MAL-2026-021756 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find claudeopuseni across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for claudeopuseni (2 malicious versions).

Part of a larger attack: 2026-09-donutautosellsrc published 9 malicious packages. See the full campaign →

Malicious package

claudeopuseniPyPI

Advisory published Oct 25, 2026Updated Oct 26, 2026

claudeopuseni is a confirmed malicious PyPI package (MAL-2026-18299) that steals credentials and exfiltrates sensitive data (malicious versions 0.1.0, 0.1.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in claudeopuseni (PyPI)

MAL-2026-18299

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall claudeopuseni

What this malware does

On import, claudeopuseni/init.py invokes _boot.check(), which issues an HTTPS GET to https://thisisafalsepositive.st/cdn/v2/claudeopuseni/manifest.json, reads field 'r' as an encrypted blob (falling back to the base64-encoded _payload.PAYLOAD bundled in _payload.py when the host is unreachable), decrypts it with a ChaCha20+HMAC routine in security.unsign keyed from sha256(b'claudeopuseni.2026.channel.v1'), and passes the plaintext to builtins.exec via an attribute name assembled from chr(101,120,101,99) to hide the sink from static scanners. _boot gates detonation on the presence of a real user profile (USERPROFILE/HOME containing Documents or Downloads) and on absence of DAS_STAGED=1 or claudeopuseni_TELEMETRY=0, and caches a timestamp to suppress re-execution within 6 hours — a sandbox/CI evasion wrapper. The embedded fallback blob guarantees execution of attacker-controlled code even when the remote host is unavailable. The resulting code runs with the importing developer's privileges on any machine that imports the package in a normal user environment. The package name resembles the Anthropic Claude product family, consistent with a typosquat lure.

During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in the Polygon blockchain.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-donutautosellsrc

Reasons (based on the campaign):

infostealer
Downloads and executes a remote executable.
obfuscation
The package contains code to detect if it is running in a sandbox environment.
malware
native-extension
steganography
c2-in-blockchain

Malicious versions

2 flagged

0.1.00.1.1

Indicators of compromise (SHA-256)

355cfc006ca4cb062c248bf2108be828c6164ae20d12ee5c7794ab68ee351843

4304d9b2064d8e9c445c86165f8155cdd504f9cca24a8ad41343b702a01ad6e7

715421a3b919f086db6ad4a57d6c8d6d333b019e3a63e607be95cf3fcb7aef5d

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for claudeopuseni (2 malicious versions).
If you installed it — respond
claudeopuseni is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If claudeopuseni was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. claudeopuseni on PyPI has been identified as a malicious package (versions 0.1.0, 0.1.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-09-donutautosellsrcIN-MAL-2026-021760IN-MAL-2026-021756

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks claudeopuseni-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database