What does the testjsonn1 malware do?

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-ronnyfredd-exfiltr-clipboard Reasons (based on the campaign): - peristence-autorun - clipboard-stealing - The OpenSSF Package Analysis project identified 'testjsonn1' @ 0.6 (pypi) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Which versions of testjsonn1 are malicious?

The following PyPI versions of testjsonn1 are flagged malicious: 0.1, 0.2, 0.3, 0.4, 0.6, 0.7. Treat any of these as compromised.

How do I remediate testjsonn1 if I installed it?

testjsonn1 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed testjsonn1 — how do I know if it already compromised me?

If testjsonn1 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is testjsonn1 part of a known attack campaign?

Yes — testjsonn1 is associated with the 2024-07-ronnyfredd-exfiltr-clipboard campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find testjsonn1 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for testjsonn1 (6 malicious versions).

Malicious package

testjsonn1PyPI

Advisory published Jul 21, 2024Updated Dec 12, 2025

testjsonn1 is a confirmed malicious PyPI package (MAL-2024-7839) that steals credentials and exfiltrates sensitive data (malicious versions 0.1, 0.2, 0.3…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in testjsonn1 (PyPI)

MAL-2024-7839

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall testjsonn1

What this malware does

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2024-07-ronnyfredd-exfiltr-clipboard

Reasons (based on the campaign):

peristence-autorun
clipboard-stealing

The OpenSSF Package Analysis project identified 'testjsonn1' @ 0.6 (pypi) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.

Malicious versions

6 flagged

0.10.20.30.40.60.7

Indicators of compromise (SHA-256)

2d25fdeb9912953dee8657737ed45cf80388580eb8d6a9ab61a46be72ef1b1a6

bf62344bfe57433818982c35f3c264e65fdab1d00a53f3a27007df60b12a4470

1f827541ec2a75802b2b89da37ad6da8289e88afa6b4a23275e6e0b374116f1d

d8b57f71eadeb645df871ae41a475cb9a8ba647679e7455f66e0c9e9b5627651

4cce90d464a762ccdf78d8a680df00ae260e3403a1eb39e41adfbad9acaea4d0

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for testjsonn1 (6 malicious versions).
If you installed it — respond
testjsonn1 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If testjsonn1 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. testjsonn1 on PyPI has been identified as a malicious package (versions 0.1, 0.2, 0.3, 0.4, 0.6, 0.7 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2024-07-ronnyfredd-exfiltr-clipboard

References

bad-packages.kam193.eu

Credits

Kamil Mańkowski (kam193)
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks testjsonn1-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database