Supply chain · pip · High

CRITICAL: Malicious 'tsshare' package in PyPI contains obfuscated code

Threat Engine Auto-Feed · data current as of 2026-09-08

A critical severity malicious package, 'tsshare' version 1.0.19, was found in the PyPI ecosystem containing obfuscated code. Organizations using this package are exposed to potential arbitrary code execution, necessitating immediate detection and remediation.

  • Package: pip / tsshare
  • Affected versions: = 1.0.19
  • Severity: critical
  • Reach: ~400/wk
  • Exposure: 70/100 (High)

What happened — Malicious package

The 'tsshare' package, specifically version 1.0.19, was identified as containing malicious obfuscated code within its 'client.py' file. This indicates an intentional compromise designed to execute unauthorized actions.

How the attack works

This is a malicious package attack, where a seemingly legitimate software component is injected with harmful code. When the package is installed and executed as part of a build process or application runtime, the embedded malicious code can perform unauthorized actions on the host system, potentially leading to data exfiltration, system compromise, or further network penetration.

Who's exposed

Profiles most at risk

  • Development teams using PyPI
  • Organizations with CI/CD pipelines that pull Python dependencies
  • Any system or application that has installed 'tsshare' version 1.0.19

Conditions that increase exposure

  • Unpinned dependencies allowing automatic updates to vulnerable versions
  • Lack of dependency lockfiles (e.g., requirements.txt.lock) in projects
  • Use of internal package mirrors that have not synchronized with PyPI's removal of the malicious package
  • Automated build processes that do not vet new package versions

Blast-radius scenarios

  • An attacker could achieve arbitrary code execution on developer machines or build servers where the package is installed.
  • Compromised systems could lead to data theft, credential exposure, or the establishment of persistent access within the organization's network.
  • The blast radius extends to any environment where the affected version of 'tsshare' is deployed, including production systems if the package made it through the deployment pipeline.

What to do (defensive)

Detect

  • Scan dependency trees for 'tsshare' version 1.0.19 in all Python projects.
  • Review build logs and package installation histories for evidence of 'tsshare' 1.0.19 being pulled.
  • Monitor network traffic for unusual outbound connections from systems that installed Python dependencies around the publication date (2026-09-08).

Contain

  • Immediately quarantine or isolate any systems identified as having installed 'tsshare' version 1.0.19.
  • Block 'tsshare' version 1.0.19 at your network perimeter and in internal package registries to prevent further ingress.
  • Temporarily halt builds that pull Python dependencies until a full audit is complete.

Remediate

  • Remove 'tsshare' version 1.0.19 from all affected environments and replace it with a known safe version or alternative if necessary.
  • Force-update all Python dependencies to known good versions and pin them using lockfiles.
  • Rotate credentials for any systems or services that may have been exposed by the malicious package.
  • Conduct a forensic analysis on compromised systems to determine the extent of the breach and any data exfiltration.

Frontier verdict — High

Prioritize immediate detection and removal of 'tsshare' version 1.0.19 due to critical severity and potential for arbitrary code execution.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.