Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
Malicious package

me-dheeraj-moye-moyePyPI

Malicious code in me-dheeraj-moye-moye (PyPI) Remove it immediately and rotate any exposed credentials.

MAL-2024-5357
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
pip uninstall me-dheeraj-moye-moye

What this malware does

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: 2024-01-moye-moye

Reasons (based on the campaign):

  • exfiltration-ssh-keys

  • exfiltration-env-variables

  • The package overrides the install command in setup.py to execute malicious code during installation.

Malicious versions

5 flagged
1.0.21.0.31.0.41.0.51.0.6

Indicators of compromise (SHA-256)

e9751c876ec60b4ac1f33119dd874e1a2df62ab4c591b49c435e7b2464e44a18
175f7b8e33bb186ce423b59f76ac0d17400f5a9a7501d0e3589ae4c89c7bbd4b
4357d53df067e02d70773e8119a4b9f595bd05bdcb902914fdb6ab0cc58e0182
92a9a2d167594b96c62e975655c136b63e63dcf5c45497938b6331f4fb6b9bc7
949eb172fab094554969d43d644bac8636a6eada1760773bb258fb9e248635f5
bb5845d4cd8ea6ddf3cfb5d57ad28faf3d0758570e8eb9e8728211e4e0bef50e
f14dec91314d88f7c707ba09f1fe8ae618f9de8d4cb7aa9e63ae584b7f91c320

Detection & response playbook

Credential / info stealer

  1. Find it

    Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for me-dheeraj-moye-moye (5 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging me-dheeraj-moye-moye across your stack and pipelines.

  2. If you installed it — respond

    me-dheeraj-moye-moye is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

  3. Did it already run?

    If me-dheeraj-moye-moye was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

  4. How O3 protects you

    O3 blocks me-dheeraj-moye-moye before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. me-dheeraj-moye-moye on PyPI has been identified as a malicious package (versions 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-04139RLUA-2024-085052024-01-moye-moyeRLUA-2026-00506

References

Credits

  • Kamil Mańkowski (kam193)
  • ReversingLabs · finder

Detect & block this

O3 blocks me-dheeraj-moye-moye-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring
me-dheeraj-moye-moye (PyPI) malicious package — MAL-2024-5357 | O3 Security