Which versions of easyaillm are malicious?

The following PyPI versions of easyaillm are flagged malicious: 2.0.15, 2.0.16. Treat any of these as compromised.

How do I remediate easyaillm if I installed it?

easyaillm is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed easyaillm — how do I know if it already compromised me?

If easyaillm was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is easyaillm part of a known attack campaign?

Yes — easyaillm is associated with the 2026-06-easyaillm, IN-MAL-2026-006446, IN-MAL-2026-006445 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find easyaillm across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for easyaillm (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging easyaillm across your stack and pipelines.

Malicious package

easyaillmPyPI

Malicious code in easyaillm (PyPI) Remove it immediately and rotate any exposed credentials.

MAL-2026-5756

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall easyaillm

What this malware does

On pip install easyaillm, setup.py runs exec(base64.b64decode(...)) which decodes to code that fetches https://pastebin.com/raw/hEF5HaFc, treats the response body as a second URL, downloads that URL's bytes to pkg_installer.exe, and executes it via os.system('cmd /c pkg_installer.exe'). The attack stages are concealed behind a base64 blob and exec() indirection, while the package metadata advertises an unrelated LLM/Roblox API purpose as cover. The pastebin source is mutable and anonymous, allowing the operator to swap the second-stage URL and ultimately the executed binary at any time. Installing this package on Windows results in arbitrary attacker-controlled code execution on the installer's machine.

During installation, the obfuscsted code attempts to download and start a malicious executable. The published versions contained issues preventing successful downloading, but it was possible to recover the intended executable during the analysis.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-easyaillm

Reasons (based on the campaign):

Downloads and executes a remote executable.
obfuscation
malware
tool:mshta

Malicious versions

2 flagged

2.0.152.0.16

Indicators of compromise (SHA-256)

8b2e19d96463fddff4bb8d7b73696ea1929c0cd8bb4948204e0913c77da0fbb7

b0cfcf55b6a8ee07ad52674f63dceafc20f70f4aa26e982055ab117caf492a1f

b6268f175708584b9c3de408c80de3dc1162f4d1ddedb1ce6201b90f409b0dea

49a89e2a264a57c1c5316080b20439b7b50b022db53db99efcce9b2bed887162

5862ce814dcb10eaca11b3835a7ca2f8a74b206c3e9696727fbd2316c7bafda1

f9f144a0f18c580e476d613e3a5224eb5966d44bab0c20880b0fe93e83de1ef2

a08d3871109fa50918608928ea7aaa533e5f99ac68cb20cbaa9558836f3d44bd

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for easyaillm (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging easyaillm across your stack and pipelines.
If you installed it — respond
easyaillm is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If easyaillm was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks easyaillm before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. easyaillm on PyPI has been identified as a malicious package (versions 2.0.15, 2.0.16 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-06-easyaillmIN-MAL-2026-006446IN-MAL-2026-006445

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks easyaillm-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring