Which versions of houdus are malicious?

The following PyPI versions of houdus are flagged malicious: 1.0.0, 1.0.1. Treat any of these as compromised.

How do I remediate houdus if I installed it?

houdus is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed houdus — how do I know if it already compromised me?

If houdus was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is houdus part of a known attack campaign?

Yes — houdus is associated with the 2026-09-houdus, IN-MAL-2026-019648 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find houdus across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for houdus (2 malicious versions).

Malicious package

houdusPyPI

Advisory published Sep 4, 2026Updated Sep 6, 2026

houdus is a confirmed malicious PyPI package (MAL-2026-15933) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 1.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in houdus (PyPI)

MAL-2026-15933

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall houdus

What this malware does

The package advertises random-number helpers but its generator.py side-loads houdus/assests/ssd.wav as Python via importlib.util.spec_from_file_location + exec_module the first time any of its RNG APIs (pick_int, select_item, etc.) is called. The.wav file is Python source shipped under a mismatched extension and contains: multi-signal VM/sandbox detection (WMI, CPUID hypervisor bit, MAC/BIOS/registry checks), RAM checks, 30-second sleeps, and a base64-encoded URL decoding to https://lamabdefs-sesaonion-ho.netlify.app/wobble.py. On non-sandbox Windows hosts the loader silently installs pycryptodome, downloads wobble.py into %APPDATA%\Microsoft\Windows\Start Menu\Programs<python>\wobble.wav, launches it with pythonw.exe using CREATE_NO_WINDOW, and self-deletes. The Start Menu Programs path and headless pythonw launch provide persistence and stealth. Extension disguise, base64 URL obfuscation, and anti-analysis gating rule out any benign interpretation; nothing in the package's stated RNG purpose requires remote code execution.

During import, package loads code disguised as ".wav" file. It performs extensive fingerprinting against sandboxes, and finally downloads and executes heavily obfuscated code. The remote code tries once more to avoid sandbox execution, establishes persistence via scheduled tasks and executes shellcode. Malicious code targets only Windows.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-houdus

Reasons (based on the campaign):

obfuscation
Downloads and executes a remote malicious script.
The package contains code to detect if it is running in a sandbox environment.
persistence
shellcode

Malicious versions

2 flagged

1.0.01.0.1

Indicators of compromise (SHA-256)

bc6489d5591dcf39fcccf4a96be83949d2cf1d7b569a7cd09c45037610bc85a3

94c533504ec9815f9ba159827d0c7516c779d03d31fc3ac897317fdbc14c2805

6f1c6df3b6cf8e44eceecfcd1aa44ee0301e8921b0c5294560c0031c0b17b6e6

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for houdus (2 malicious versions).
If you installed it — respond
houdus is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If houdus was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. houdus on PyPI has been identified as a malicious package (versions 1.0.0, 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-09-houdusIN-MAL-2026-019648

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks houdus-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database