Which versions of package-lib8127 are malicious?

The following PyPI versions of package-lib8127 are flagged malicious: 0.1. Treat any of these as compromised.

How do I remediate package-lib8127 if I installed it?

package-lib8127 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed package-lib8127 — how do I know if it already compromised me?

If package-lib8127 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is package-lib8127 part of a known attack campaign?

Yes — package-lib8127 is associated with the RLMA-2024-11109, 2024-09-cstealer, RLUA-2026-00580 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find package-lib8127 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for package-lib8127 (version 0.1).

Malicious package

package-lib8127PyPI

Advisory published Sep 17, 2024Updated Mar 19, 2026

package-lib8127 is a confirmed malicious PyPI package (MAL-2024-11653) that steals credentials and exfiltrates sensitive data (malicious version 0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in package-lib8127 (PyPI)

MAL-2024-11653

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall package-lib8127

What this malware does

Package contains CStealer, a known infostealer, starting on importing the module.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2024-09-cstealer

Reasons (based on the campaign):

infostealer
infostealer:cstealer

Malicious versions

1 flagged

0.1

Indicators of compromise (SHA-256)

405c3386e34c4a6fca3f897cdbe4e9586c5cb5c6d279aee9aa2f156aabffabc7

d9d7feadd0badfdc1588fa10de040419c37b7a760ee8174c819c2b78b1b05749

2e0e446a5a40a8c6a1ea1041fa0fc875ef0dab2a8ad10cc74e459221906e6851

3cf0541bba671db30b333009f5916f72ed6f47323e49d2b7675bc508a7cc2606

f1058a08ee1c03de71c882d875c6652cddcd05f527c6d0f3f0dedade29730332

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for package-lib8127 (version 0.1).
If you installed it — respond
package-lib8127 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If package-lib8127 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. package-lib8127 on PyPI has been identified as a malicious package (version 0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-111092024-09-cstealerRLUA-2026-00580

References

Credits

Kamil Mańkowski (kam193)
ReversingLabs · finder

Detect & block this

O3 blocks package-lib8127-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database