Which versions of dt-validator are malicious?

The following PyPI versions of dt-validator are flagged malicious: 0.3.0. Treat any of these as compromised.

How do I remediate dt-validator if I installed it?

dt-validator is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed dt-validator — how do I know if it already compromised me?

If dt-validator was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is dt-validator part of a known attack campaign?

Yes — dt-validator is associated with the 2026-06-dt-validator, IN-MAL-2026-008966 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find dt-validator across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for dt-validator (version 0.3.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging dt-validator across your stack and pipelines.

Malicious package

dt-validatorPyPI

Malicious code in dt-validator (PyPI) Remove it immediately and rotate any exposed credentials.

MAL-2026-6728

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall dt-validator

What this malware does

The package's top-level public API dt_validator.validate() — colocated in __all__ with legitimate helpers validate_extension, validate_size, and validate_checksum — unconditionally issues an HTTP request to a hardcoded https://file-api.free.beeceptor.com endpoint (a shared public HTTP-mock service on the free-tier subdomain, not publisher-controlled infrastructure), then compile()s the response body and exec()s it in the CALLER's module globals, obtained via inspect.currentframe().f_back.f_globals (see api_client.py DEFAULT_API_ENDPOINT and validate_data(..., allow_exec=True, namespace=caller_globals)). Endpoint names on beeceptor's free shared subdomain are not authenticated to the maintainer — anyone who claims or has claimed that endpoint name can serve arbitrary Python that runs with the caller's identity and full access to the caller's module namespace. The README further documents a different default host (file-read.free.beeceptor.com) than the code actually contacts (file-api.free.beeceptor.com), so a developer auditing README does not see the destination the code reaches. Execution is not install-time or import-time — a caller must invoke validate() — but the API name and colocation are engineered to be hit by a developer who thinks they are calling an input validator. No installer-secret reads, no lifecycle hooks, and no other exfil/backdoor mechanisms are present. Routing to human review: the remote-exec-into-caller-globals surface via an unowned shared mock host is a real risk to consumers who call validate(), but harm requires the developer to invoke the API rather than firing on pip install/import.

Code contains a function to execute remote code, which at the time of analysis was extracting the "auth_user" table from Django DB. The remote code execution is partially documented and disguised with multiple warnings, but a) the 'convenience function' uses a hardcoded endpoint and loads results to the global namespace, b) the warnings are silenced by default.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-dt-validator

Reasons (based on the campaign):

Downloads and executes a remote malicious script.
action-hidden-in-lib-usage

Malicious versions

1 flagged

0.3.0

Indicators of compromise (SHA-256)

0fc0256380d811cdce05ffa9c3644a5f7e4ebd6f7acfce0f955935b42449b17a

b0dd6dc392ad68861c938e7798773adf5359c835743e711a834d84221b481bdf

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for dt-validator (version 0.3.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging dt-validator across your stack and pipelines.
If you installed it — respond
dt-validator is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If dt-validator was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks dt-validator before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. dt-validator on PyPI has been identified as a malicious package (version 0.3.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-06-dt-validatorIN-MAL-2026-008966

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks dt-validator-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring