Which versions of spotify2youtubemusic are malicious?

The following PyPI versions of spotify2youtubemusic are flagged malicious: 0.1, 0.1.1, 0.1.2, 0.1.3. Treat any of these as compromised.

How do I remediate spotify2youtubemusic if I installed it?

Remove spotify2youtubemusic from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed spotify2youtubemusic — how do I know if it already compromised me?

If spotify2youtubemusic was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is spotify2youtubemusic part of a known attack campaign?

Yes — spotify2youtubemusic is associated with the RLMA-2024-04837, RLUA-2024-09304 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find spotify2youtubemusic across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for spotify2youtubemusic (4 malicious versions).

Malicious package

spotify2youtubemusicPyPI

spotify2youtubemusic is a confirmed malicious PyPI package (MAL-2024-6034) that executes malicious code on install (malicious versions 0.1, 0.1.1, 0.1.2…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in spotify2youtubemusic (PyPI)

MAL-2024-6034

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall spotify2youtubemusic

Malicious versions

4 flagged

0.10.1.10.1.20.1.3

Indicators of compromise (SHA-256)

56b4ece4880061c893a80f0b8a7fdb646c5138ce87173b45a1e7a6abd4bfab73

2618979760ab0eeef52346d0fdfb333dd23f48b763f62ad18a6416c606eeca50

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for spotify2youtubemusic (4 malicious versions).
If you installed it — respond
Remove spotify2youtubemusic from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If spotify2youtubemusic was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. spotify2youtubemusic on PyPI has been identified as a malicious package (versions 0.1, 0.1.1, 0.1.2, 0.1.3 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-04837RLUA-2024-09304

Credits

ReversingLabs · finder

Detect & block this

O3 blocks spotify2youtubemusic-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database