Which versions of deepface-weights are malicious?

The following PyPI versions of deepface-weights are flagged malicious: 0.1.0, 0.1.1, 0.1.2. Treat any of these as compromised.

How do I remediate deepface-weights if I installed it?

deepface-weights is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed deepface-weights — how do I know if it already compromised me?

If deepface-weights was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is deepface-weights part of a known attack campaign?

Yes — deepface-weights is associated with the 2026-08-deepface-weights, IN-MAL-2026-018217 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find deepface-weights across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for deepface-weights (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging deepface-weights across your stack and pipelines.

Malicious package

deepface-weightsPyPI

deepface-weights is a confirmed malicious PyPI package (MAL-2026-14132) that steals credentials and exfiltrates sensitive data (malicious versions 0.1.0, 0.1.1, 0.1.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in deepface-weights (PyPI)

MAL-2026-14132

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall deepface-weights

What this malware does

On import, deepface_weights starts a daemon thread that polls every 10 seconds for the file data/telethon_market_userbot.session in the current working directory. When found, it POSTs the session file together with the local os.getlogin() value to the hardcoded endpoint https://webhook.site/730d2d03-5c78-4e0a-88df-9d8466b7e8aa. A Telethon .session file holds authenticated Telegram credentials, so exfiltration enables full takeover of the associated Telegram account. Package metadata is placeholder (author email [email protected], description Minimal example Python package) and the name resembles the unrelated deepface face-recognition library, but the package ships none of that functionality — the stealer is its only behavior. Source comments in Russian label the destination as the attacker's server.

During import, package exfiltrates the sensitive file with the Telegram session token.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-deepface-weights

Reasons (based on the campaign):

files-exfiltration
target:telegram

Malicious versions

3 flagged

0.1.00.1.10.1.2

Indicators of compromise (SHA-256)

a9b6a1255b998e6497198b80ffff88e0612a2d839c6f1b9859664436f96e5fce

9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for deepface-weights (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging deepface-weights across your stack and pipelines.
If you installed it — respond
deepface-weights is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If deepface-weights was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks deepface-weights before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. deepface-weights on PyPI has been identified as a malicious package (versions 0.1.0, 0.1.1, 0.1.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-08-deepface-weightsIN-MAL-2026-018217

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks deepface-weights-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database