Which versions of spy-ai are malicious?

The following PyPI versions of spy-ai are flagged malicious: 0.1, 0.1.3, 1.0, 1.0.0, 1.0.1, 1.1, 1.1.0, 1.1.1, 1.1.3. Treat any of these as compromised.

How do I remediate spy-ai if I installed it?

spy-ai is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed spy-ai — how do I know if it already compromised me?

If spy-ai was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is spy-ai part of a known attack campaign?

Yes — spy-ai is associated with the 2024-09-spider-ai campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find spy-ai across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for spy-ai (9 malicious versions).

Malicious package

spy-aiPyPI

Advisory published Oct 2, 2024Updated Apr 22, 2026

spy-ai is a confirmed malicious PyPI package (MAL-2024-12351) that steals credentials and exfiltrates sensitive data (malicious versions 0.1, 0.1.3, 1.0…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in spy-ai (PyPI)

MAL-2024-12351

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall spy-ai

What this malware does

Every time the user sends a message to the AI, the user IP, message as well as the response are exfiltrated to a hardcoded telegram channel. This behaviour is not mentioned in the package description. Instead, the description lures to offer advanced features.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2024-09-spider-ai

Reasons (based on the campaign):

exfiltration-generic
A Telegram webhook is used to send collected data.
action-hidden-in-lib-usage

Malicious versions

9 flagged

0.10.1.31.01.0.01.0.11.11.1.01.1.11.1.3

Indicators of compromise (SHA-256)

751c9eeed2ec7246092237af521e06377fe0899fe815c11175a8cac1195d47c1

d71096c3aa8cb143ba7fab208ab313a240e8f1f9846b17b947a01f729fc1864a

1f14a74be2a5dc314937cc2e527ac9bb1b3d76c633b6d3bdfc72dfce460f7db6

9d5643ef1befe879e71d0d23d1827a7d8c333323bfec1e60b2653643f43f57f2

d7e2784981f9af026d1361f8018c5b19b43803bf376645650f5d22bc518d0d18

6d3eb4576e277cb131fa35dbca033b4cb3ebb35f810435997537b82deb88c2dc

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for spy-ai (9 malicious versions).
If you installed it — respond
spy-ai is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If spy-ai was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. spy-ai on PyPI has been identified as a malicious package (versions 0.1, 0.1.3, 1.0, 1.0.0, 1.0.1, 1.1, 1.1.0, 1.1.1, and 1 more flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2024-09-spider-ai

References

bad-packages.kam193.eu

Credits

Kamil Mańkowski (kam193)

Detect & block this

O3 blocks spy-ai-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database