What does the ryry-cli malware do?

ryry-cli runs as a long-lived agent that connects to a hardcoded WebSocket at wss://api.dalipen.com/aigc/task/connect and executes Python scripts under subprocess.Popen based on task messages sent by that server. During its polling loop it calls aigc/task/getAutoDeployWidget and, for each entry the server returns, runs `pip install ` on arbitrary wheels or downloads a zip and installs its requirements.txt, giving the remote endpoint unattended code execution on the host. utils.check_restart() writes a shell script that runs `apt-get update && apt-get upgrade && apt-get install -y...` and `pip install -U ryry-cli` and schedules it via `at now + 1 minutes` or Windows schta

Which versions of ryry-cli are malicious?

The following PyPI versions of ryry-cli are flagged malicious: 6.26, 6.28. Treat any of these as compromised.

How do I remediate ryry-cli if I installed it?

Remove ryry-cli from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed ryry-cli — how do I know if it already compromised me?

If ryry-cli was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is ryry-cli part of a known attack campaign?

Yes — ryry-cli is associated with the IN-MAL-2026-010736, IN-MAL-2026-010761 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find ryry-cli across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for ryry-cli (2 malicious versions).

Malicious package

ryry-cliPyPI

Advisory published Jul 16, 2026Updated Jul 16, 2026

ryry-cli is a confirmed malicious PyPI package (MAL-2026-10759) that executes malicious code on install (malicious versions 6.26, 6.28). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in ryry-cli (PyPI)

MAL-2026-10759

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall ryry-cli

What this malware does

ryry-cli runs as a long-lived agent that connects to a hardcoded WebSocket at wss://api.dalipen.com/aigc/task/connect and executes Python scripts under subprocess.Popen based on task messages sent by that server. During its polling loop it calls aigc/task/getAutoDeployWidget and, for each entry the server returns, runs pip install <server-supplied URL> on arbitrary wheels or downloads a zip and installs its requirements.txt, giving the remote endpoint unattended code execution on the host. utils.check_restart() writes a shell script that runs apt-get update && apt-get upgrade && apt-get install -y... and pip install -U ryry-cli and schedules it via at now + 1 minutes or Windows schtasks, mutating system packages and self-upgrading the CLI outside the user's package manager. taskUtils posts JSON payloads containing socket.gethostname() and a MAC/CPU-serial-derived device id, plus task log files, to a hardcoded WeChat work webhook at qyapi.weixin.qq.com/cgi-bin/webhook/send with an embedded key. A server-supplied Mihomo/Clash subscription URL fetched from aigc/task/config is applied by proxy_manager to route the agent's outbound traffic through an author-controlled proxy configuration. The package also embeds base64-encoded Aliyun OSS access-key ID and secret (utils.K1/K2) that are decoded at runtime and used to PUT files to the author's p-template-hk / p-upload-gz buckets.

Malicious versions

2 flagged

6.266.28

Indicators of compromise (SHA-256)

0f7442ffccbf15fb45fc58c95556658f0070d3f0fdb3956bb5a3afa2b0cf4be2

4a305ba94c92b6ec62aaf627fc1213d9e37e1645f37fd033f61c7becaba71edd

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for ryry-cli (2 malicious versions).
If you installed it — respond
Remove ryry-cli from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If ryry-cli was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. ryry-cli on PyPI has been identified as a malicious package (versions 6.26, 6.28 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-010736IN-MAL-2026-010761

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks ryry-cli-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database