Which versions of dexat2 are malicious?

The following PyPI versions of dexat2 are flagged malicious: 2. Treat any of these as compromised.

How do I remediate dexat2 if I installed it?

dexat2 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed dexat2 — how do I know if it already compromised me?

If dexat2 was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is dexat2 part of a known attack campaign?

Yes — dexat2 is associated with the RLMA-2025-00457, GENERIC-standard-pypi-install-pentest, RLUA-2026-00263 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find dexat2 across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for dexat2 (version 2). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging dexat2 across your stack and pipelines.

Malicious package

dexat2PyPI

Malicious code in dexat2 (PyPI) Remove it immediately and rotate any exposed credentials.

MAL-2025-918

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall dexat2

What this malware does

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: GENERIC-standard-pypi-install-pentest

Reasons (based on the campaign):

The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
The package overrides the install command in setup.py to execute malicious code during installation.

Malicious versions

1 flagged

Indicators of compromise (SHA-256)

1330a416e87ce86be42dd25cd89d0bb4949c71091f7f415d6e601676df8f11e7

b2d9e73142a64666ffa6bc94b30ba9066eb3cc7b6eba286c52321c384ebc86cd

be5e1bf90856aef1ce6fad28972a1f6e0dc091251467174b762d9ceca7842e77

3a6cae1c5ed5c4842f8c4c5f9abd10eb2057ed7602a613ad8afa28c486c120ac

8f0a2486023e55048f29fa7330cddc86774ce23c2f36ce6fa49993c8561b68e0

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for dexat2 (version 2). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging dexat2 across your stack and pipelines.
If you installed it — respond
dexat2 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If dexat2 was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks dexat2 before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. dexat2 on PyPI has been identified as a malicious package (version 2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2025-00457GENERIC-standard-pypi-install-pentestRLUA-2026-00263

References

bad-packages.kam193.eu

Credits

Kamil Mańkowski (kam193)
ReversingLabs · finder

Detect & block this

O3 blocks dexat2-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring