Supply chain · pip · High

Critical Typosquatting: Malicious 'fflask' Package in PyPI Ecosystem

Threat Engine Auto-Feed · data current as of 2026-07-15

A malicious package named 'fflask' (version 3.1.8.dev0) was identified in the PyPI ecosystem, designed to act as an infostealer. This package leverages typosquatting to trick users into installing it, leading to data exfiltration and persistence on affected systems. Organizations using PyPI should verify their dependencies to avoid this critical supply-chain risk.

  • Package: pip / fflask
  • Affected versions: = 3.1.8.dev0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Typosquatting

The 'fflask' package, specifically version 3.1.8.dev0, was found to contain malicious code. Upon import, this module initiates the download and execution of an infostealer. The attack aims to exfiltrate sensitive data and establish persistence on the compromised system through autorun directories.

How the attack works

This is a typosquatting attack, where a malicious package is named similarly to a legitimate one (e.g., 'fflask' instead of 'flask') to trick developers. If a user or automated system mistakenly installs the typosquatted package, the embedded malicious code executes. This typically involves fetching and running a secondary payload to achieve objectives like data theft or system control.

Who's exposed

Profiles most at risk

  • Development teams using the PyPI ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest dependencies
  • Any user or system that has installed 'fflask' version 3.1.8.dev0

Conditions that increase exposure

  • Unpinned dependencies in project manifests (e.g., requirements.txt without specific versions)
  • Lack of dependency lockfiles (e.g., poetry.lock, Pipfile.lock) to ensure consistent builds
  • Reliance on internal package mirrors that may not filter malicious packages
  • Human error in typing package names during manual installation

Blast-radius scenarios

  • An attacker gains access to sensitive data (e.g., browser data, cryptocurrency information) from the compromised system.
  • The attacker establishes persistent access on the system, potentially leading to further compromise or lateral movement within the network.
  • Compromised developer workstations or build environments could inject malicious code into legitimate software projects.

What to do (defensive)

Detect

  • Review dependency lists (e.g., requirements.txt, pyproject.toml) for 'fflask' version 3.1.8.dev0.
  • Scan project dependencies using software composition analysis (SCA) tools for known malicious packages.
  • Monitor network traffic for unusual outbound connections from development or build environments that might indicate data exfiltration.
  • Check system autorun directories for suspicious entries.

Contain

  • Immediately isolate any systems identified with 'fflask' version 3.1.8.dev0 installed.
  • Block network communication from affected systems to known malicious C2 infrastructure if identified.
  • Suspend builds or deployments that might pull the affected package.
  • Rotate credentials that may have been exposed on compromised systems.

Remediate

  • Remove 'fflask' version 3.1.8.dev0 from all affected environments and dependency lists.
  • Replace the malicious package with the legitimate intended package (e.g., 'flask') after careful verification.
  • Force all development and build environments to use pinned, immutable dependency versions.
  • Implement strict package naming conventions and review processes for new dependencies.
  • Conduct a thorough forensic analysis on compromised systems to identify the extent of data exfiltration and persistence.

Frontier verdict — High

Prioritize immediate detection and removal of 'fflask' version 3.1.8.dev0 due to its critical severity as an infostealer and persistence mechanism.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.