Supply chain · pip · High

Malicious pip package 'riakcs' (v0.0.1) exfiltrates host data on install

Threat Engine Auto-Feed · data current as of 2026-08-09

A malicious version 0.0.1 of the 'riakcs' package in the pip ecosystem has been identified. Installation or import of this package leads to the exfiltration of basic host information, posing a credential/secret theft risk to affected systems.

  • Package: pip / riakcs
  • Affected versions: = 0.0.1
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The 'riakcs' package, specifically version 0.0.1, was found to contain malicious code. This code is designed to exfiltrate basic information about the host system upon installation or module import. The package serves no other legitimate purpose.

How the attack works

This supply-chain attack leverages a malicious software package to compromise systems. The attacker publishes a package to a public registry, which, when installed, executes code to collect and transmit sensitive host data. This can occur during the installation process itself, often by overriding standard installation commands, or when the module is imported into a project.

Who's exposed

Profiles most at risk

  • Development teams using pip to manage Python dependencies
  • CI/CD pipelines that pull Python packages from public registries
  • Organizations with systems that directly install or import 'riakcs' version 0.0.1

Conditions that increase exposure

  • Unpinned dependencies that allow fetching the latest version of 'riakcs'
  • Lack of dependency lockfiles (e.g., requirements.txt with exact versions)
  • Use of internal package mirrors that may not filter malicious packages
  • Automated build processes that install dependencies without manual review

Blast-radius scenarios

  • An attacker could obtain basic host information (e.g., IP address, username) from compromised systems.
  • The exfiltrated data could be used for further reconnaissance or to facilitate more targeted attacks.
  • Any system where 'riakcs' version 0.0.1 was installed or imported is at risk of information exposure.

What to do (defensive)

Detect

  • Scan dependency trees for 'riakcs' version 0.0.1 in all Python projects.
  • Monitor network traffic for unusual outbound connections from systems that installed Python packages.
  • Review `setup.py` files or package manifests for suspicious `install` command overrides or unusual scripts.

Contain

  • Immediately quarantine any systems identified with 'riakcs' version 0.0.1 installed.
  • Block 'riakcs' version 0.0.1 at your package registry or proxy to prevent further installations.
  • Isolate development and build environments that may have installed the malicious package.

Remediate

  • Remove 'riakcs' version 0.0.1 from all affected systems and projects.
  • Force a password reset for any credentials that may have been present or accessible on compromised hosts.
  • Implement strict dependency pinning and use lockfiles to prevent accidental installation of malicious versions.
  • Conduct a thorough audit of all systems that interacted with the malicious package for further compromise.

Frontier verdict — High

Prioritize immediate detection and removal of 'riakcs' v0.0.1 due to critical severity and credential/secret theft risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.