Which versions of ironic-secureboot-driver are malicious?

The following PyPI versions of ironic-secureboot-driver are flagged malicious: 31463.0.0. Treat any of these as compromised.

How do I remediate ironic-secureboot-driver if I installed it?

Remove ironic-secureboot-driver from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed ironic-secureboot-driver — how do I know if it already compromised me?

If ironic-secureboot-driver was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is ironic-secureboot-driver part of a known attack campaign?

Yes — ironic-secureboot-driver is associated with the RLMA-2025-04184, RLUA-2025-04778, RLUA-2025-05611 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find ironic-secureboot-driver across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for ironic-secureboot-driver (version 31463.0.0).

Malicious package

ironic-secureboot-driverPyPI

Advisory published Aug 28, 2025Updated Dec 2, 2025

ironic-secureboot-driver is a confirmed malicious PyPI package (MAL-2025-41692) that executes malicious code on install (malicious version 31463.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in ironic-secureboot-driver (PyPI)

MAL-2025-41692

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall ironic-secureboot-driver

Malicious versions

1 flagged

31463.0.0

Indicators of compromise (SHA-256)

fe10b90082437d7c4261a6080b0bdec0aa31f2cf31d64e2fe42b2337a6d6ace3

44acc33b7501a690b8dc0d69961f50bbaa432a6f1eb180e7dcaec670cc726be9

63c2246be3ecb538b671c3dddb34555c8d561c32cf3a1381f1b037f40f7e1d48

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for ironic-secureboot-driver (version 31463.0.0).
If you installed it — respond
Remove ironic-secureboot-driver from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If ironic-secureboot-driver was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. ironic-secureboot-driver on PyPI has been identified as a malicious package (version 31463.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2025-04184RLUA-2025-04778RLUA-2025-05611

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks ironic-secureboot-driver-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database