goodoldtoulasPyPI
Advisory published Updated
goodoldtoulas is a confirmed malicious PyPI package (MAL-2026-5271) that runs destructive / sabotage code (malicious version 0.1.0). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in goodoldtoulas (PyPI)
What this malware does
During pip install goodoldtoulas, setup.py invokes setup_helper() which downloads main.exe from https://cold-eu-par-1.gofile.io/download/web/deb39e07-da2d-4081-a86b-6380e555788c/main.exe (anonymous file host) into C:\MALWARE_DELETE and executes it via os.system('main.exe') (setup.py lines 6, 21, 33). The fetch is unpinned, has no hash verification, the destination is an opaque Windows binary, the host is not the publisher's domain, and the staging path name is self-incriminating. Any installer running pip install of this package on Windows fetches and executes an attacker-controlled binary at install time.
During installation, package attempts to download and run an executable imitating malicious activity.
Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
Campaign: 2026-06-goodoldtoulas
Reasons (based on the campaign):
-
The package overrides the install command in setup.py to execute malicious code during installation.
-
Downloads and executes a remote executable.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Destructive / sabotageFind it
Search your lockfiles and build artifacts for goodoldtoulas (version 0.1.0).
If you installed it — respond
goodoldtoulas carries a destructive/sabotage payload. Remove it immediately, restore any affected data from clean backups, and verify integrity of build outputs that may have been tampered with.
Did it already run?
If goodoldtoulas was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
- Kamil Mańkowski (kam193) · reporter
Detect & block this
O3 blocks goodoldtoulas-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.