Which versions of xAyOuB-XcTxTeaM are malicious?

The following PyPI versions of xAyOuB-XcTxTeaM are flagged malicious: 0.1.0, 0.1.1, 0.1.2. Treat any of these as compromised.

How do I remediate xAyOuB-XcTxTeaM if I installed it?

Remove xAyOuB-XcTxTeaM from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed xAyOuB-XcTxTeaM — how do I know if it already compromised me?

If xAyOuB-XcTxTeaM was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is xAyOuB-XcTxTeaM part of a known attack campaign?

Yes — xAyOuB-XcTxTeaM is associated with the IN-MAL-2026-016478, IN-MAL-2026-016479, IN-MAL-2026-016477 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find xAyOuB-XcTxTeaM across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for xAyOuB-XcTxTeaM (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging xAyOuB-XcTxTeaM across your stack and pipelines.

Malicious package

xAyOuB-XcTxTeaMPyPI

xAyOuB-XcTxTeaM is a confirmed malicious PyPI package (MAL-2026-13426) that executes malicious code on install (malicious versions 0.1.0, 0.1.1, 0.1.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in xayoub-xctxteam (PyPI)

MAL-2026-13426

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall xAyOuB-XcTxTeaM

What this malware does

On import xAyOuB_XcTxTeaM, init.py automatically starts a Flask HTTP server bound to 0.0.0.0:50019 exposing /spam?uid=, /stop, and /status endpoints. Any remote party able to reach the installer's host on that port can supply an arbitrary uid and cause the package to drive outbound abuse traffic from the installer's IP. In parallel, import-time background threads log in ~20 hardcoded Garena Free Fire guest accounts (shipped as accounts.json in the sdist) against loginbp.ggpolarbear.com and 100067.connect.garena.com using a hardcoded OAuth client_id=100067 and client_secret, open game rooms, and emit openroom/spmroom/SEnd_InV invite-spam packets to the remote-supplied target. TLS verification is disabled for the game-service HTTPS calls (verify=False, ssl._create_unverified_context(), urllib3.disable_warnings). The package additionally ships 20 uid:password pairs and a Garena OAuth client secret in cleartext. Installing/importing this package exposes an unauthenticated remote-control interface on the installer's host and uses the installer's IP as an abuse source against a third-party service.

Malicious versions

3 flagged

0.1.00.1.10.1.2

Indicators of compromise (SHA-256)

c9c522a1186f6892c457d6fb0e74b840aa6e2d0302a75dce45cb45a4f86d04c6

e150a2084afb57b865384c624d91da477fe2a6ac09e84640a4f831a4a9b48a56

e7ba43c2aa10f9c8468fe74511f88f6d8020387d91d133331ead29ac08631f9d

Detection & response playbook

Malicious package

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for xAyOuB-XcTxTeaM (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging xAyOuB-XcTxTeaM across your stack and pipelines.
If you installed it — respond
Remove xAyOuB-XcTxTeaM from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If xAyOuB-XcTxTeaM was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks xAyOuB-XcTxTeaM before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. xAyOuB-XcTxTeaM on PyPI has been identified as a malicious package (versions 0.1.0, 0.1.1, 0.1.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-016478IN-MAL-2026-016479IN-MAL-2026-016477

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks xAyOuB-XcTxTeaM-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database