What does the privacypass-py malware do?

The package presents itself as 'Privacy Pass client primitives' but ships no cryptographic functionality. Its only runtime effect is a data-exfiltration beacon. setup.py invokes a `_report()` routine during build/install that collects hostname, username, current working directory, argv, the parent process command line read from /proc/ /cmdline, and environment variable names and values matching credential-related prefixes (AWS_, GITHUB_, PIP_, and others), then POSTs the JSON payload to the hardcoded bare-IP endpoint http://85.190.112.236:8881/b/ over plain HTTP. privacypass_py/__init__.py repeats the same beacon at module top level, calling `_report('import')` on every `import p

Which versions of privacypass-py are malicious?

The following PyPI versions of privacypass-py are flagged malicious: 0.1.99, 0.1.100, 0.1.101. Treat any of these as compromised.

How do I remediate privacypass-py if I installed it?

privacypass-py is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed privacypass-py — how do I know if it already compromised me?

If privacypass-py was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is privacypass-py part of a known attack campaign?

Yes — privacypass-py is associated with the IN-MAL-2026-022471, GENERIC-standard-pypi-install-pentest campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find privacypass-py across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for privacypass-py (3 malicious versions).

Malicious package

privacypass-pyPyPI

Advisory published Nov 1, 2026Updated Nov 1, 2026

privacypass-py is a confirmed malicious PyPI package (MAL-2026-18435) that steals credentials and exfiltrates sensitive data (malicious versions 0.1.99, 0.1.100, 0.1.101). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in privacypass-py (PyPI)

MAL-2026-18435

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall privacypass-py

What this malware does

The package presents itself as 'Privacy Pass client primitives' but ships no cryptographic functionality. Its only runtime effect is a data-exfiltration beacon. setup.py invokes a _report() routine during build/install that collects hostname, username, current working directory, argv, the parent process command line read from /proc/<ppid>/cmdline, and environment variable names and values matching credential-related prefixes (AWS_, GITHUB_, PIP_, and others), then POSTs the JSON payload to the hardcoded bare-IP endpoint http://85.190.112.236:8881/b/<nonce> over plain HTTP. privacypass_py/init.py repeats the same beacon at module top level, calling _report('import') on every import privacypass_py with an expanded prefix list (CLOUDFLARE_, SUPERTOKENS, HOME, USER, PATH) and an additional secretish_names list filtered by substrings KEY/SECRET/TOKEN/PASS/CRED/PRIVATE/SEED/MNEMONIC/SIGNATURE/COOKIE/SESSION/AUTH, sent to http://85.190.112.236:8881/f/<nonce>. The import-time path fires outside pip build isolation. The name and description function as cover for a package whose only shipped code is the beacon.

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: GENERIC-standard-pypi-install-pentest

Reasons (based on the campaign):

The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
The package overrides the install command in setup.py to execute malicious code during installation.

Malicious versions

3 flagged

0.1.990.1.1000.1.101

Indicators of compromise (SHA-256)

0ca6e88317dac5ec524d2dc6ec4b2af7934e2213569ed7c8a757e59edb45b0c3

1c4699b191565636c74fc5e6e8ece237bb0186ca11f021298ac91b2931756c09

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for privacypass-py (3 malicious versions).
If you installed it — respond
privacypass-py is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If privacypass-py was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. privacypass-py on PyPI has been identified as a malicious package (versions 0.1.99, 0.1.100, 0.1.101 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-022471GENERIC-standard-pypi-install-pentest

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks privacypass-py-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database