Which versions of sherpy are malicious?

The following PyPI versions of sherpy are flagged malicious: 0.1.0, 0.1.1. Treat any of these as compromised.

How do I remediate sherpy if I installed it?

sherpy is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed sherpy — how do I know if it already compromised me?

If sherpy was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is sherpy part of a known attack campaign?

Yes — sherpy is associated with the 2026-09-sherpy, IN-MAL-2026-020598, IN-MAL-2026-020602 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find sherpy across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for sherpy (2 malicious versions).

Malicious package

sherpyPyPI

Advisory published Sep 25, 2026Updated Sep 28, 2026

sherpy is a confirmed malicious PyPI package (MAL-2026-17188) that steals credentials and exfiltrates sensitive data (malicious versions 0.1.0, 0.1.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in sherpy (PyPI)

MAL-2026-17188

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall sherpy

What this malware does

The sherpy package presents itself as an OSINT command-line tool but ships all of its logic inside a 10.8 MB precompiled PyO3 native module at sherpy/_core.abi3.so. The Python surface is a trivial shim: sherpy/__init__.py is empty and sherpy/cli.py only forwards to three entry points in the native module — osi(), send_tg_ar(), and send_tg_trt(). The compiled crate manifest links teloxide (Telegram Bot API client), reqwest/hyper (HTTP), dirs (home-directory locators), walkdir (recursive filesystem enumeration), zip (archiving), and wallet-relevant cryptographic crates aes, chacha20, bs58, and pbkdf2, plus windows-sys for Windows host access. The send_tg_* naming combined with this dependency set matches a Telegram-bot exfiltration stealer: enumerate the user's home directory, collect wallet keystores and credential files, package them, and upload to an attacker-controlled Telegram bot whose token and chat ID are hardcoded inside the opaque binary. Running the advertised CLI therefore causes the installer's wallet and credential material to be exfiltrated to the author's Telegram endpoint. The behavior is hidden inside a compiled native module with no source shipped, defeating text-based source review.

When used, the package exfiltrates Chrome extension files (likely targeting cryptocurrency wallets) and sensitive Telegram files.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-sherpy

Reasons (based on the campaign):

infostealer
exfiltration-crypto
target:telegram
native-extension

Malicious versions

2 flagged

0.1.00.1.1

Indicators of compromise (SHA-256)

2e5440f1e24545fd14e73c7fc459a9abf893f4674683899ed29ff7c4189416b6

561bac708df60298c46df70c27282912b3955ec3fd83a23e251c268e814cdcbf

ccf9ac745692bddc25946cb3bb58b90aebf56714a2f578d80a1ca9f25c195ff9

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for sherpy (2 malicious versions).
If you installed it — respond
sherpy is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If sherpy was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. sherpy on PyPI has been identified as a malicious package (versions 0.1.0, 0.1.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-09-sherpyIN-MAL-2026-020598IN-MAL-2026-020602

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks sherpy-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database