Supply chain · pip · High

Critical Malicious Package 'getpubip' in PyPI Ecosystem Steals Credentials

Threat Engine Auto-Feed · data current as of 2026-10-15

The PyPI package 'getpubip' version 0.1.0 contains malicious code that downloads and executes an infostealer during import. This poses a critical supply-chain risk, as it can lead to credential and secret theft, including browser data exfiltration.

  • Package: pip / getpubip
  • Affected versions: = 0.1.0
  • Severity: critical
  • Reach: ~85/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The PyPI package 'getpubip' version 0.1.0 was found to contain malicious code. During the package import process, obfuscated code within 'getpubip' downloads and executes an infostealer. This malicious activity is categorized as having clearly malicious intent, specifically designed for information theft.

How the attack works

This is a dependency confusion or typosquatting attack where a malicious package masquerades as a legitimate one or is pulled in by mistake. Upon import, the package executes obfuscated code to fetch and run a secondary payload. This payload then attempts to collect sensitive information, such as credentials and browser data, from the compromised system for exfiltration.

Who's exposed

Profiles most at risk

  • Development teams using the PyPI ecosystem
  • CI/CD pipelines configured to pull the latest unpinned dependencies
  • Organizations with internal package mirrors that may have ingested the malicious version

Conditions that increase exposure

  • Projects with unpinned dependencies that could resolve to 'getpubip' version 0.1.0
  • Lack of dependency lockfiles (e.g., requirements.txt with exact versions)
  • Automated build processes that do not vet new package versions
  • Environments where 'getpubip' 0.1.0 was installed, even transitively

Blast-radius scenarios

  • An attacker gains access to credentials, API keys, and other secrets stored on the compromised system.
  • Sensitive browser data, including session tokens and personal information, is exfiltrated.
  • The compromised system could be used as a pivot point for further attacks within the network, expanding the blast radius.

What to do (defensive)

Detect

  • Scan dependency trees for 'getpubip' version 0.1.0 in all projects.
  • Monitor network traffic for unusual outbound connections from build systems or applications that use PyPI packages.
  • Implement runtime application self-protection (RASP) or endpoint detection and response (EDR) solutions to flag suspicious process behavior or unauthorized data access.
  • Review package integrity using checksums or signatures where available.

Contain

  • Immediately quarantine any systems or environments found to have installed 'getpubip' version 0.1.0.
  • Block 'getpubip' version 0.1.0 from being downloaded from package registries or internal mirrors.
  • Isolate affected development and build environments from production systems.
  • Rotate credentials and API keys that may have been exposed on compromised systems.

Remediate

  • Remove 'getpubip' version 0.1.0 from all project dependencies and replace with a known safe alternative if functionality is required, or remove entirely.
  • Force-update all dependencies to known good versions, utilizing lockfiles to ensure deterministic builds.
  • Perform a comprehensive security audit of all systems that may have interacted with the malicious package.
  • Educate developers on best practices for dependency management, including pinning versions and scrutinizing new packages.

Frontier verdict — High

Prioritize immediate detection and removal of 'getpubip' version 0.1.0 due to critical credential theft risk and active infostealer execution upon import.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.