Supply chain · pip · High

Critical Malicious Package 'wacve-utils' in PyPI Targets Linux/Android Data

Threat Engine Auto-Feed · data current as of 2026-08-02

The PyPI package `wacve-utils` version 1.0.7 contains malicious code designed to exfiltrate sensitive data from Linux and Android systems. This poses a critical supply-chain risk for any projects or environments that have installed this specific package version.

  • Package: pip / wacve-utils
  • Affected versions: = 1.0.7
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

A malicious version (1.0.7) of the `wacve-utils` package was published to PyPI. This package includes obfuscated code that, upon execution, acts as an infostealer, specifically targeting Linux and Android environments (including Termux).

How the attack works

This attack involves a malicious package being introduced into a software supply chain. When the compromised package is installed and executed, it deploys encrypted code. This code then collects sensitive information, such as files, browser data, and text messages, and exfiltrates it to an external channel, in this case, a Telegram channel. The package also attempts to download and execute additional remote malicious scripts.

Who's exposed

Profiles most at risk

  • Development teams using the PyPI ecosystem
  • CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Organizations with Linux-based development or production environments
  • Users of Android devices running Termux who install Python packages

Conditions that increase exposure

  • Projects with unpinned dependencies that could resolve to `wacve-utils` version 1.0.7
  • Lack of dependency lockfiles (e.g., `requirements.txt.lock`)
  • Use of internal package mirrors that have synchronized the malicious version
  • Environments where `wacve-utils` 1.0.7 was directly or transitively installed

Blast-radius scenarios

  • An attacker could gain unauthorized access to sensitive files and browser data from compromised Linux systems.
  • On Android devices running Termux, an attacker could exfiltrate text messages and other personal data.
  • The execution of remote malicious scripts could lead to further compromise, including persistent access or deployment of additional malware, expanding the blast radius beyond initial data theft.

What to do (defensive)

Detect

  • Scan dependency trees for `wacve-utils` version 1.0.7 in all projects and environments.
  • Monitor network traffic for suspicious outbound connections, especially to Telegram channels or unknown remote servers, from systems that installed Python packages.
  • Review system logs for unusual process execution or file access patterns following package installations.

Contain

  • Immediately isolate any systems or environments found to have installed `wacve-utils` version 1.0.7.
  • Block network communication to known exfiltration endpoints or suspicious domains from affected systems.
  • Revoke any credentials or API keys that may have been present on compromised systems.

Remediate

  • Remove `wacve-utils` version 1.0.7 from all affected environments and projects.
  • Force a rebuild of all affected applications and images with verified, clean dependencies.
  • Implement strict dependency pinning and use lockfiles to prevent accidental installation of malicious versions.
  • Conduct a thorough forensic analysis on any compromised systems to identify the full extent of data exfiltration and potential further compromise.

Frontier verdict — High

Prioritize immediate detection and removal of `wacve-utils` version 1.0.7 due to its critical infostealer capabilities targeting Linux and Android systems.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.