Which versions of pyobfuscation are malicious?

The following PyPI versions of pyobfuscation are flagged malicious: 0.1.0. Treat any of these as compromised.

How do I remediate pyobfuscation if I installed it?

pyobfuscation is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed pyobfuscation — how do I know if it already compromised me?

If pyobfuscation was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is pyobfuscation part of a known attack campaign?

Yes — pyobfuscation is associated with the RLMA-2025-03668, 2025-05-pyobfuscation, RLUA-2026-00641 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find pyobfuscation across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for pyobfuscation (version 0.1.0).

Malicious package

pyobfuscationPyPI

Advisory published Jun 3, 2025Updated Mar 19, 2026

pyobfuscation is a confirmed malicious PyPI package (MAL-2025-6570) that steals credentials and exfiltrates sensitive data (malicious version 0.1.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in pyobfuscation (PyPI)

MAL-2025-6570

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall pyobfuscation

What this malware does

During installation, an executable is downloaded and started. It's been identified to contain Brute Ratel C4 components

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-05-pyobfuscation

Reasons (based on the campaign):

Downloads and executes a remote executable.
malware
obfuscation

Malicious versions

1 flagged

0.1.0

Indicators of compromise (SHA-256)

4f7751b060181cea4f3b7da11f3306c9057843379d6b0aca2f22afebebf30042

058fcd870cd771f9287f8a5004423f12ad7d47f5fce5840eb25c348534fdf6c2

f8e00692944f5cafaa4c7fdb9974554f20629bd4581e2c68baa5f1b0ca675def

91d282d471eada34f3697e9705cc7be31875eceddefd054edf1a249c1d4a2928

c5e1f568a3b49a8e9b8f06dff161ba0fdbaf317d85584df26472d1ceb52c04e2

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for pyobfuscation (version 0.1.0).
If you installed it — respond
pyobfuscation is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If pyobfuscation was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. pyobfuscation on PyPI has been identified as a malicious package (version 0.1.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2025-036682025-05-pyobfuscationRLUA-2026-00641

References

bad-packages.kam193.eu

Credits

Kamil Mańkowski (kam193)
ReversingLabs · finder

Detect & block this

O3 blocks pyobfuscation-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database