Which versions of webt00n are malicious?

The following PyPI versions of webt00n are flagged malicious: 1.0. Treat any of these as compromised.

How do I remediate webt00n if I installed it?

Remove webt00n from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed webt00n — how do I know if it already compromised me?

If webt00n was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is webt00n part of a known attack campaign?

Yes — webt00n is associated with the RLMA-2024-05007, RLUA-2024-09517 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find webt00n across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for webt00n (version 1.0).

Malicious package

webt00nPyPI

webt00n is a confirmed malicious PyPI package (MAL-2024-6203) that executes malicious code on install (malicious version 1.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in webt00n (PyPI)

MAL-2024-6203

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall webt00n

Malicious versions

1 flagged

1.0

Indicators of compromise (SHA-256)

c296f55a7973fbd56f124dbad42de47210f4d0affec7a7e2d65b839de758628d

8b4c91ba48c329f962571348bae72a1a35acc4a81edff56a5192c4ee42a2ec2e

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for webt00n (version 1.0).
If you installed it — respond
Remove webt00n from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If webt00n was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. webt00n on PyPI has been identified as a malicious package (version 1.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-05007RLUA-2024-09517

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks webt00n-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database