Supply chain · pip · High

Critical Malicious Package 'minecraftmodes' in PyPI Exfiltrates Roblox Cookies

Threat Engine Auto-Feed · data current as of 2026-09-06

A malicious version of the 'minecraftmodes' package (0.3.3) in the PyPI ecosystem has been identified as an infostealer. It is designed to exfiltrate Roblox cookies from victim machines, posing a critical risk to users who have installed this specific version.

  • Package: pip / minecraftmodes
  • Affected versions: = 0.3.3
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The 'minecraftmodes' package, specifically version 0.3.3, was found to contain malicious code. This code is designed to act as an infostealer, with the primary objective of exfiltrating Roblox cookies from systems where it is installed.

How the attack works

This attack involves a malicious software package distributed through a public repository. When a user installs the compromised version, the embedded malicious code executes, typically during installation or import. This code then searches for and extracts sensitive data, such as authentication tokens or session cookies, from the host system and transmits them to an attacker-controlled destination.

Who's exposed

Profiles most at risk

  • Developers and organizations using the PyPI ecosystem
  • Teams whose build processes or development environments pull 'minecraftmodes' as a dependency
  • Users with Roblox accounts who have installed the affected package on their machines

Conditions that increase exposure

  • Unpinned dependencies that allow automatic updates to the malicious version
  • Lack of dependency lockfiles (e.g., requirements.txt.lock) in projects
  • Use of internal mirrors that do not vet package integrity or rely on public repository metadata

Blast-radius scenarios

  • An attacker gains unauthorized access to Roblox accounts via stolen cookies, potentially leading to account takeover.
  • Compromised user sessions could be leveraged for further social engineering or credential harvesting.
  • The presence of malicious code indicates a potential vector for broader system compromise beyond initial cookie exfiltration.

What to do (defensive)

Detect

  • Scan dependency trees for 'minecraftmodes' version 0.3.3.
  • Monitor network traffic for unusual outbound connections from development or production systems that have installed this package.
  • Review package integrity checks and hashes against known good versions if available.

Contain

  • Immediately isolate any systems found to have installed 'minecraftmodes' version 0.3.3.
  • Block network access for identified compromised systems to prevent further data exfiltration.
  • Revoke and re-issue any credentials or session tokens that may have been exposed, especially Roblox cookies.

Remediate

  • Remove 'minecraftmodes' version 0.3.3 from all affected environments and replace with a known safe version or alternative.
  • Force password resets and invalidate all active sessions for Roblox accounts associated with potentially compromised machines.
  • Conduct a thorough forensic analysis on affected systems to identify the full extent of compromise and any additional malicious activity.

Frontier verdict — High

Prioritize immediate detection and removal of 'minecraftmodes' version 0.3.3 due to critical infostealer capabilities targeting Roblox cookies.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.