Which versions of py-ckrd are malicious?

The following PyPI versions of py-ckrd are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate py-ckrd if I installed it?

Remove py-ckrd from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed py-ckrd — how do I know if it already compromised me?

If py-ckrd was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is py-ckrd part of a known attack campaign?

Yes — py-ckrd is associated with the RLMA-2024-04368, RLUA-2024-08801 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find py-ckrd across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for py-ckrd (version 1.0.0).

Malicious package

py-ckrdPyPI

py-ckrd is a confirmed malicious PyPI package (MAL-2024-5586) that executes malicious code on install (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in py-ckrd (PyPI)

MAL-2024-5586

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall py-ckrd

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

a44741882f23d49ce12a3edfbd9b6204b266aeab4b0899232c7f6ef73a30ea7c

4a5d1a9e69ced3a355a68228ae03c5883e829feca228671e67d78ef18cbaae3a

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for py-ckrd (version 1.0.0).
If you installed it — respond
Remove py-ckrd from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If py-ckrd was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. py-ckrd on PyPI has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-04368RLUA-2024-08801

References

Credits

ReversingLabs · finder

Detect & block this

O3 blocks py-ckrd-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database