Which versions of colorstack are malicious?

The following PyPI versions of colorstack are flagged malicious: 0.1.0, 0.1.1. Treat any of these as compromised.

How do I remediate colorstack if I installed it?

colorstack is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed colorstack — how do I know if it already compromised me?

If colorstack was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is colorstack part of a known attack campaign?

Yes — colorstack is associated with the 2026-07-colorstack, IN-MAL-2026-011209, IN-MAL-2026-011207 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find colorstack across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for colorstack (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging colorstack across your stack and pipelines.

Malicious package

colorstackPyPI

colorstack is a confirmed malicious PyPI package (MAL-2026-10976) that steals credentials and exfiltrates sensitive data (malicious versions 0.1.0, 0.1.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in colorstack (PyPI)

MAL-2026-10976

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall colorstack

What this malware does

The package publishes as 'colorstack' with a summary advertising a color/gradient library, but installs under the import name 'newcolors' and exposes two functions unrelated to color generation. The exported colors() function POSTs to the hardcoded endpoint https://www.fastsyncapi.com/v1/colors, writes the response body to a temporary file preserving the server-supplied filename extension, and dispatches it through the OS via os.startfile on Windows or subprocess.run with open/xdg-open on macOS/Linux. Because the remote server chooses both the filename and the bytes, extensions such as.exe/.bat/.ps1/.lnk on Windows or.command/.desktop/.app handlers on macOS/Linux are executed by the OS shell, giving the operator of fastsyncapi.com arbitrary code execution on any host that calls colors(). A second function, update(activation_key), collects the installer's hostname, locale-derived country code, and a SHA-256 device hash derived from the hostname and the MAC address returned by uuid.getnode(), and POSTs those fields together with the activation key to https://www.fastsyncapi.com/v1/update; the response token is persisted to ~/.config/newcolors/vtoken.json. The hostname+MAC-derived HWID is a stable per-host fingerprint that lets the operator uniquely identify installers and select per-host payloads through the colors() channel. The fastsyncapi.com domain has no relation to a color library, and the package name/summary/README serve as a cover story for this fetch-and-execute and fingerprinting behavior.

The package hides code to download and execute a remote executable from a newly created fastsyncapi[.]com domain. It is disguised as a remote 'fast color helper,' as opposed to the local helper, also included in the code, that only mimics any functionality. The malicious part is not immediately active: to download the binary, a key is required, which was not included in the analyzed versions. The downloaded binary is executed, and at least in one case disguised as 'AppHostRegistrationVerifier'. The package is likely prepared for multi-stage infection, but the trigger code using it was not identified.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-colorstack

Reasons (based on the campaign):

Downloads and executes a remote executable.
action-hidden-in-lib-usage

Malicious versions

2 flagged

0.1.00.1.1

Indicators of compromise (SHA-256)

e622a7f45c572488da7a3dcea95a8deb6a56b0dfd843cd85483373bd03fb8974

05f3b08a41e5239924e109a14b8d91b4542bbbdddb1138a1bc6c9cfb7137b053

fdae4c3866cd34c123d585f9bbce41ec84280ac5d0d8a7c3dd77d5747469eb2f

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for colorstack (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging colorstack across your stack and pipelines.
If you installed it — respond
colorstack is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If colorstack was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks colorstack before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. colorstack on PyPI has been identified as a malicious package (versions 0.1.0, 0.1.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-07-colorstackIN-MAL-2026-011209IN-MAL-2026-011207

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks colorstack-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database