Which versions of syswatch are malicious?

The following PyPI versions of syswatch are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate syswatch if I installed it?

syswatch is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed syswatch — how do I know if it already compromised me?

If syswatch was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is syswatch part of a known attack campaign?

Yes — syswatch is associated with the 2026-08-envprovision, IN-MAL-2026-019321 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find syswatch across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for syswatch (version 1.0.0).

Malicious package

syswatchPyPI

Advisory published Sep 1, 2026Updated Sep 2, 2026

syswatch is a confirmed malicious PyPI package (MAL-2026-15811) that steals credentials and exfiltrates sensitive data (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in syswatch (PyPI)

MAL-2026-15811

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall syswatch

What this malware does

Importing syswatch starts a background thread that, on Windows, fetches a JSON manifest from https://github-repo.up.railway.app/vbv_a8F3kL92xQ/manifest.json, downloads the executable referenced by manifest.update_url to a temp path, and runs it silently with NSIS-style flags (/S /NCRC). The endpoint URL is stored as base64 fragments concatenated at runtime (_FRAGMENTS + _decode in _monitor.py), and TLS verification is explicitly disabled for both manifest and payload fetches (check_hostname=False, verify_mode=CERT_NONE). After execution the code launches a ServiceHelperUtility.exe helper and calls wevtutil cl Application and wevtutil cl System from _cleanup() to erase Windows event logs. The host github-repo.up.railway.app is a Railway-hosted lookalike of GitHub, not a GitHub-owned domain. The package advertises itself as a system-monitoring library; none of the fetch, execute, or event-log clearing behavior is disclosed.

During import, malicious code is started in the background. On Windows, it downloads and installs a malicious executable, and disguises it as a system utility. After installation, the code attempts to cover its tracks by cleaning logs and removing downloaded files. The installed executable is a heavily obfuscated malware with multiple sandbox evasion techniques, finally running an infostealer identifying itself as "Snow Stealer". It collects at least browser data and modifies cryptowallet applications.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-envprovision

Reasons (based on the campaign):

infostealer
Downloads and executes a remote executable.
obfuscation
action-hidden-in-lib-usage
exfiltration-browser-data
The package contains code to detect if it is running in a sandbox environment.
exfiltration-crypto
malware
covering-tracks
persistence

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

863ff540be3399380239a471217fc84175f06c66bedc0fc0f89901fbaae46a38

e01fd8b85a9d6bdfbefb70261f49496f8a6c224d98da6400ef0ca06f18404d27

740c9125f18d68081f742b3316d07c54727fb4aab5555a398c0c04e31ba9bb54

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for syswatch (version 1.0.0).
If you installed it — respond
syswatch is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If syswatch was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. syswatch on PyPI has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-08-envprovisionIN-MAL-2026-019321

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks syswatch-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database