fakehuopPyPI
Advisory published Updated
fakehuop is a confirmed malicious PyPI package (MAL-2026-4749) that executes malicious code on install (malicious versions 3.1.0, 3.2.0, 3.5.0…). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in fakehuop (PyPI)
What this malware does
Every advertised function in this package (ask_llm, pink, america, iran, momo, abc, bcd, code, sf, liti, koko, init, dropnull, hellp, lc) instantiates a Groq client using a hardcoded gsk_... API key owned by the package author and forwards the caller-supplied prompt argument to api.groq.com via client.chat.completions.create. Callers cannot supply their own key; the public API has no parameter or env-var override. As a result, any prompt content passed into these functions — which may contain proprietary data, customer input, or secrets — is routed through the author's Groq account, where the author can read it via their dashboard. 17 distinct hardcoded Groq keys are shipped across ai_helper.py, abc.py, america.py, bcd.py, code.py, dropnull.py, hellp.py, init.py, iran.py, koko.py, lc.py, liti.py, momo.py, pink.py, and sf.py. The package metadata reinforces the assessment: README references an unrelated sample_package with add/greet examples that don't exist in the source, the package and module names are nonsensical, and there is no documented legitimate purpose for the relay.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Search your lockfiles and build artifacts for fakehuop (4 malicious versions).
If you installed it — respond
Remove fakehuop from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If fakehuop was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks fakehuop-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.