goodoltoulasPyPI
Advisory published Updated
goodoltoulas is a confirmed malicious PyPI package (MAL-2026-5272) that runs destructive / sabotage code (malicious version 0.1.0). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in goodoltoulas (PyPI)
What this malware does
On pip install goodoltoulas, setup.py unconditionally invokes setup_helper(), which downloads an opaque PE binary from an anonymous file-hosting service (storage.filebin.net) into C:\MALWARE_DELETE\main.exe and launches it via subprocess.Popen with CREATE_NEW_CONSOLE. There is no hash check, signature verification, or version pinning, and the host is unrelated to any package publisher. The library surface is a thin decoy: init.py forwards all attribute access to the requests module and the README advertises 'A simple request cloner for Python', providing cover for the install-time dropper. The drop path uses a self-incriminating directory name (C:\MALWARE_DELETE) and the response carries application/vnd.microsoft.portable-executable, confirming hostile intent. Any Windows installer running pip install will execute attacker-controlled code immediately.
During installation, package attempts to download and run an executable imitating malicious activity.
Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
Campaign: 2026-06-goodoldtoulas
Reasons (based on the campaign):
-
The package overrides the install command in setup.py to execute malicious code during installation.
-
Downloads and executes a remote executable.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Destructive / sabotageFind it
Search your lockfiles and build artifacts for goodoltoulas (version 0.1.0).
If you installed it — respond
goodoltoulas carries a destructive/sabotage payload. Remove it immediately, restore any affected data from clean backups, and verify integrity of build outputs that may have been tampered with.
Did it already run?
If goodoltoulas was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
- Kamil Mańkowski (kam193) · reporter
Detect & block this
O3 blocks goodoltoulas-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.