Which versions of fetchium are malicious?

The following PyPI versions of fetchium are flagged malicious: 1.0.0, 1.0.1. Treat any of these as compromised.

How do I remediate fetchium if I installed it?

fetchium is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed fetchium — how do I know if it already compromised me?

If fetchium was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is fetchium part of a known attack campaign?

Yes — fetchium is associated with the 2026-11-fetchium, IN-MAL-2026-022655, IN-MAL-2026-022656 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find fetchium across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for fetchium (2 malicious versions).

Malicious package

fetchiumPyPI

Advisory published Nov 13, 2026Updated Nov 13, 2026

fetchium is a confirmed malicious PyPI package (MAL-2026-19203) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 1.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in fetchium (PyPI)

MAL-2026-19203

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall fetchium

What this malware does

The package presents itself as a small collection of web/utility helpers (greet/clamp) but ships a covert loader that executes on first import. init.py unconditionally invokes _loader.run() inside a bare try/except so any failure is swallowed silently. _loader.py is approximately 1.9 MB of base64+zlib-encoded chunks (the _CH tuple) plus a Windows dropper harness configured with _TARGET='MicrosoftEdgeUpdate.msi', _XARGS=['/qn','/quiet','/norestart'] and _SPAWN='wmi', consistent with silent MSI installation via msiexec/WMI impersonating a Microsoft Edge update. A base64-encoded JSON configuration bundled inside the loader enumerates analysis-environment indicators to evade (sandbox/cuckoo/joe/hybrid/anyrun names; VirtualBox/VMware/QEMU/Xen/Parallels process and registry fingerprints; debugging and monitoring tools such as wireshark, procmon, ida64, x64dbg; VM MAC OUI prefixes) and specifies Windows persistence under HKCU\Software\Microsoft\Windows\CurrentVersion\Run with subkey Microsoft\CoreRuntime. The advertised functionality bears no relationship to this payload, the loader is undisclosed in the README, and the metadata uses placeholder values. Importing the package on a Windows host triggers decoding and execution of the opaque payload, drop/execution of an MSI masquerading as a Microsoft update, and installation of a Run-key persistence entry.

During import package runs an embedded malicious executable.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-fetchium

Reasons (based on the campaign):

obfuscation
The package contains code to detect if it is running in a sandbox environment.
malware
persistence
peristence-autorun

Malicious versions

2 flagged

1.0.01.0.1

Indicators of compromise (SHA-256)

5b286fc27984ad73cb490d8c5e92be039af62676f22a75c500c2090e137c318b

01ceb360b0c2d18e31f2a2f5c370bcb652417afa9b6eca94a153f5baaaf6211a

43c9afa5780e67590b380f5b8b5bc783b346465d7e52c83e54efc43825c52ad3

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for fetchium (2 malicious versions).
If you installed it — respond
fetchium is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If fetchium was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. fetchium on PyPI has been identified as a malicious package (versions 1.0.0, 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-11-fetchiumIN-MAL-2026-022655IN-MAL-2026-022656

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks fetchium-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database