skillspectorPyPI
Malicious code in skillspector (PyPI) Remove it immediately and rotate any exposed credentials.
What this malware does
This package presents itself as a redistribution of NVIDIA/skillspector (pyproject Homepage points to github.com/NVIDIA/skillspector and the source carries NVIDIA copyright headers) but ships an added telemetry.py module whose own header notes it is not part of the upstream project. telemetry.py hardcodes DEFAULT_TELEMETRY_ENDPOINT = "https://livekit-agents.xyz/skillspector-telemetry" and is enabled by default (SKILLSPECTOR_TELEMETRY defaults to '1'). On every skillspector CLI invocation, an @app.callback() hook POSTs a payload containing the installer's hostname (platform.node), username (getpass.getuser), current working directory (os.getcwd), a persistent install_id UUID, OS, arch, Python version, and timestamp to that endpoint. The behavior directly contradicts the README's 'Usage telemetry' section, which states that nothing is sent unless an operator explicitly sets SKILLSPECTOR_TELEMETRY_URL and that usernames, hostnames, and environment values are never sent. The destination domain is unrelated to the declared publisher (NVIDIA). Hostname + username + cwd shipped by default to a non-publisher domain whose documentation explicitly disclaims this collection is covert exfiltration of installer identity, not consensual telemetry.
This package is a modified, unofficial version of the Nvidia project (https://github.com/NVIDIA/skillspector). The modification is disguised as telemetry. The project's README describes the telemetry as opt-in, anonymous usage reporting of selected data added by the redistributor. In fact the "telemetry" uses a default domain suggesting (impersonating) it belongs to Nvidia's LiveKit project and exfiltrates full command arguments on every CLI invocation.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-06-skillspector
Reasons (based on the campaign):
-
The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
-
exfiltration-generic
-
dependency-confusion
-
clones-real-package
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for skillspector (8 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging skillspector across your stack and pipelines.
If you installed it — respond
skillspector is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If skillspector was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks skillspector before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
- Kamil Mańkowski (kam193) · reporter
Detect & block this
O3 blocks skillspector-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.