Supply chain · pip · High

Critical Malicious 'pafer' Package in PyPI Establishes Persistence and Remote Access

Threat Engine Auto-Feed · data current as of 2026-10-10

The 'pafer' package (version 0.9.7) in the PyPI ecosystem contains malicious code designed to establish persistence and enable remote access, leading to potential data exfiltration and arbitrary code execution. Organizations using this package are at critical risk and should immediately review their dependencies.

  • Package: pip / pafer
  • Affected versions: = 0.9.7
  • Severity: critical
  • Reach: ~117/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The 'pafer' package, specifically version 0.9.7, was found to contain malicious code. This code is designed to load a disguised pickle file from a related dependency, 'webreader'. During the unpickling process, embedded malicious code is executed, establishing persistence and downloading a next-stage payload. This ultimately transforms the affected system into a Remote Access Trojan (RAT).

How the attack works

This supply-chain attack leverages a malicious dependency. When the 'pafer' package is installed and executed, it triggers a chain of events starting with the execution of obfuscated code embedded within a seemingly innocuous configuration file (a pickle). This code then establishes a persistent foothold on the system, downloads additional malicious components, and enables remote control capabilities, including file exfiltration and arbitrary command execution.

Who's exposed

Profiles most at risk

  • Development teams using the PyPI ecosystem
  • Organizations whose CI/CD pipelines pull unpinned or latest versions of dependencies
  • Any system or application that has 'pafer' version 0.9.7 as a direct or transitive dependency

Conditions that increase exposure

  • Using unpinned dependencies in 'requirements.txt' or similar configuration files
  • Lack of dependency lockfiles (e.g., 'pip freeze > requirements.lock')
  • Pulling dependencies from internal mirrors without prior security vetting
  • Automated builds that do not scan new dependencies for known vulnerabilities

Blast-radius scenarios

  • An attacker gains persistent remote access to the compromised system.
  • Sensitive files and credentials can be exfiltrated from the affected environment.
  • Arbitrary commands can be executed on the compromised machine, leading to further compromise or lateral movement within the network.
  • The blast radius extends to any system where the malicious package was installed, potentially including development, testing, and production environments.

What to do (defensive)

Detect

  • Scan dependency trees for 'pafer' version 0.9.7.
  • Monitor network traffic for unusual outbound connections from systems running Python applications.
  • Review system logs for suspicious process creation or file modifications, especially related to Python environments or persistence mechanisms (e.g., PTH files).
  • Utilize software composition analysis (SCA) tools to identify known malicious packages in your codebase.

Contain

  • Immediately isolate any systems identified as having 'pafer' version 0.9.7 installed.
  • Block network communication from affected systems to known malicious command-and-control (C2) infrastructure.
  • Temporarily suspend deployments that include the affected package or its dependencies.
  • Review and revoke any credentials that may have been exposed on compromised systems.

Remediate

  • Remove 'pafer' version 0.9.7 and any related dependencies (e.g., 'webreader') from all affected environments.
  • Update all dependencies to known good, verified versions, preferably using pinned versions and lockfiles.
  • Perform a thorough forensic analysis on compromised systems to identify the extent of the breach and any exfiltrated data.
  • Rebuild affected systems from trusted images and rotate all credentials used on those systems.

Frontier verdict — High

Prioritize immediate detection and removal of 'pafer' version 0.9.7 due to its critical severity, persistence mechanisms, and remote access capabilities.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.