Which versions of etherumm are malicious?

The following PyPI versions of etherumm are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate etherumm if I installed it?

etherumm is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed etherumm — how do I know if it already compromised me?

If etherumm was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is etherumm part of a known attack campaign?

Yes — etherumm is associated with the RLMA-2024-08237, funcaptcha-ru campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find etherumm across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for etherumm (version 1.0.0).

Part of a larger attack: funcaptcha-ru published 161 malicious packages. See the full campaign →

Malicious package

etherummPyPI

Advisory published Jun 28, 2024Updated Dec 12, 2025

etherumm is a confirmed malicious PyPI package (MAL-2024-10010) that steals credentials and exfiltrates sensitive data (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in etherumm (PyPI)

MAL-2024-10010

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall etherumm

What this malware does

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: funcaptcha-ru

Reasons (based on the campaign):

infostealer

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

e1bbd9723519372a866afa1166945db71bfa35daf0046a21b576fe04c9a3219a

151604a6842aa85f5b1299dea619ec97ea4e392ef7473d17e8ac8a4d1e607c34

e02d272fe04fc7190d47912f0ba221f59a9899f828e0246b66bad128f3b6cd20

8f1fedd40789305e99c689731811e672b141f20a60d489eabc26041ef6480fe8

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for etherumm (version 1.0.0).
If you installed it — respond
etherumm is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If etherumm was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. etherumm on PyPI has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-08237funcaptcha-ru

References

Credits

Kamil Mańkowski (kam193)
ReversingLabs · finder

Detect & block this

O3 blocks etherumm-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database