Supply chain · pip · High

Malicious PyPI Package 'trtllm-subdir-test' Exfiltrates Host Information

Threat Engine Auto-Feed · data current as of 2026-08-01

A malicious PyPI package, 'trtllm-subdir-test' version 99999.0.0, has been identified that exfiltrates basic host information upon installation or module import. This package has no legitimate purpose and poses a critical supply-chain risk for Python environments.

  • Package: pip / trtllm-subdir-test
  • Affected versions: = 99999.0.0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The 'trtllm-subdir-test' package for the PyPI ecosystem, specifically version 99999.0.0, contains malicious code. This code is designed to exfiltrate basic information about the host system when the package is installed or its module is imported. The package serves no other functional purpose.

How the attack works

This is a supply-chain attack where a malicious package is introduced into a public registry. When a user or automated system installs this package, either directly or as a dependency, the embedded malicious code is executed. In this instance, the package overrides the install command in `setup.py` to run its malicious logic during installation, or upon module import, to collect and transmit host data.

Who's exposed

Profiles most at risk

  • Development teams using Python and PyPI
  • CI/CD pipelines that install Python dependencies
  • Organizations with internal Python applications that pull dependencies from PyPI

Conditions that increase exposure

  • Unpinned dependencies that allow fetching the latest (malicious) version
  • Lack of lockfiles (e.g., `requirements.txt.hash`) to ensure integrity
  • Use of internal mirrors that do not vet package integrity or content
  • Automated builds that install packages without content review

Blast-radius scenarios

  • An attacker gains access to basic host information (e.g., IP address, username) from any system where the package is installed or imported.
  • Compromised build environments or developer workstations could lead to further reconnaissance or lateral movement within an organization.

What to do (defensive)

Detect

  • Scan `requirements.txt` or `pyproject.toml` for direct or transitive dependencies on 'trtllm-subdir-test' version 99999.0.0.
  • Monitor network traffic for unusual outbound connections from build systems or Python environments that might indicate data exfiltration.
  • Review `setup.py` files of newly introduced or updated packages for suspicious `install` command overrides or other unusual execution logic.

Contain

  • Immediately quarantine any systems or environments found to have installed 'trtllm-subdir-test' version 99999.0.0.
  • Block 'trtllm-subdir-test' version 99999.0.0 at your package registry or proxy to prevent further installations.
  • Isolate build agents and development machines that may have interacted with this package.

Remediate

  • Remove 'trtllm-subdir-test' version 99999.0.0 from all affected environments.
  • Force a rebuild of all affected applications and images, ensuring the malicious package is no longer present.
  • Rotate any credentials or API keys that may have been present on compromised systems, as basic host information could aid further attacks.
  • Implement strict dependency pinning and use lockfiles to ensure deterministic builds and prevent automatic updates to malicious versions.

Frontier verdict — High

Prioritize immediate detection and removal of 'trtllm-subdir-test' due to its critical severity and data exfiltration capabilities.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.