GitHub Advisory PyPI malware sweep, 18 July 2026

HighAdvisory sweepPyPI

On 2026-07-18 GitHub's Advisory Database retired 3 CWE-506 PyPI malware advisories. Highlights: govpkg (versions 0.1.0, 0.2.0 - the OSSF-tagged 2026-07-govpkg campaign) silently downloads a native executable, disguises it as a system service for persistence, and uses telegra.ph (Telegraph anonymous-publishing) as C2; and a trongridev/trongridme Tron private-key exfil pair (both v0.0.1) from the recurring OSSF 2025-04-tronix campaign.

Published 18 Jul 2026

Check your requirements.txt Source advisory

At a glancepypi-2026-07-18-ghsa-malware-sweep

Packages tracked4 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity: High
Type: Advisory sweep
Published: 18 Jul 2026
Ecosystems: PyPI
Detected by: GitHub Advisory Database, OpenSSF Package Analysis
Also known as: 2026-07-18 GHSA PyPI sweep, 2026-07-govpkg campaign, 2025-04-tronix campaign
Source: github.com

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

On 2026-07-18 GitHub's Advisory Database published 3 CWE-506 (Embedded Malicious Code) advisories against PyPI packages - the largest PyPI GHSA malware sweep in the recent July cadence. Every record uses the standard "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" boilerplate.

Cluster 1 - `govpkg` (telegra.ph-C2 downloader + fake-service persistence, OSSF `2026-07-govpkg` campaign)

Package	Versions	GHSA	Campaign tag
`govpkg`	`0.1.0`, `0.2.0`	GHSA-f88m-xf6h-ph28	`2026-07-govpkg`

The payload chain:

On pip install govpkg, the package silently downloads a native executable from an attacker-controlled URL.
The executable is installed as a fake system service - a Linux systemd unit or a Windows service registration named to look like a legitimate platform daemon, so the persistence survives reboot without raising the eyebrow of anyone glancing at the service list.
The daemon polls telegra.ph (the Telegram-owned anonymous-publishing platform) for next-stage instructions, encoded as ordinary long-form article text. Telegraph pages carry no distinctive TLS SNI, no rare DNS, and are almost never egress-blocked in enterprise environments - the same dead-drop C2 pattern that ChocoPoC uses against api.mapbox.com and the 2026-07-08 tailwind-core payload uses against script.google.com, but with an even lower-signal host.
Output and stolen data are written back to attacker-controlled Telegraph pages the same way, keeping the traffic shape completely one-directional as viewed by any per-host egress filter.

OpenSSF contributor kam193 is credited with the payload attribution on the GHSA record.

Cluster 2 - `trongridev` / `trongridme` Tron private-key exfil pair (OSSF `2025-04-tronix` campaign)

Package	Version	GHSA	Campaign tag
`trongridev`	`0.0.1`	GHSA-hx6g-6877-qvg8	`2025-04-tronix`
`trongridme`	`0.0.1`	GHSA-4fhx-73c8-xxhv	`2025-04-tronix`

Both packages ship at a single 0.0.1 release and target the Tron / TRX blockchain - the name is a deliberate typosquat of the legitimate trongrid Python SDK. The stated purpose in the GHSA record is private-key exfiltration - any wallet key touched on a host that ran either package should be treated as leaked, funds moved to a fresh address, and on-chain activity audited for unauthorized withdrawals.

The 2025-04-tronix campaign has been a low-volume, high-persistence PyPI presence for over a year: OpenSSF has retired 100+ similarly-named trongrid* typosquats under this campaign identifier since April 2025. The pattern is always the same - one-off 0.0.1 releases, generic exfil payload, README often copied verbatim from a legitimate crypto SDK to defeat surface-level GitHub-README review.

Registry state

All 3 packages have been fully removed from PyPI (pypi.org/project/*/ returns 404 as of 2026-07-19). Private mirrors that cached the .tar.gz / .whl files during the publish window will keep serving them after the public yank - treat any lockfile hit as active malware regardless of what the public index currently returns.

typosquatinfostealercrypto-wallet-drainobfuscationdead-drop

Affected packages

3 packages 4 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check requirements.txt →

Impact

What it does if you installed it

Any host that installed any of the 3 packages below should be treated as fully compromised - every GHSA record uses the boilerplate CWE-506 "any computer that has this package installed or running should be considered fully compromised" language, and no patched version exists
govpkg - telegra.ph-C2 downloader with fake-service persistence (2 versions, OSSF 2026-07-govpkg campaign): govpkg@0.1.0 and govpkg@0.2.0 silently download a native executable, disguise it as a system service (Linux systemd unit / Windows service registration) so the persistence survives reboot, and use telegra.ph (the Telegram-owned anonymous-publishing platform) as a command-and-control dead-drop. Telegraph pages look like ordinary long-form articles to a network egress filter, and the malware polls a specific Telegraph URL for next-stage instructions encoded as text - same dead-drop shape as ChocoPoC-on-Mapbox and tailwind-core-on-Google-Sheets but with an even lower-signal host (telegra.ph is not on most enterprise egress-block lists). Payload attribution credit: OpenSSF contributor kam193
trongridev + trongridme - Tron private-key exfil pair (2 packages, OSSF 2025-04-tronix campaign): both packages ship at 0.0.1 and both are designed to exfiltrate cryptocurrency private keys, specifically targeting the Tron / TRX blockchain (the name typosquats the legitimate trongrid Python SDK). The advisories note "some packages additionally clone the readme of other, legit libraries" - a deception layer to defeat surface-level GitHub-README review. The 2025-04-tronix campaign has been a low-volume, high-persistence PyPI presence for over a year - OpenSSF has retired 100+ similarly-named trongrid* packages under this campaign identifier since April 2025
None of the 3 packages have surviving version files on the public PyPI index - every version has been fully removed (pypi.org/project/*/ returns 404). Private PyPI mirrors (Artifactory, Nexus, pip-index-lockfile caches) that cached the .tar.gz or .whl files during the publish window WILL keep serving them after the public yank - lockfile hits on these names must be treated as active malware regardless of what pypi.org currently returns

What to do

Clean-up steps

Grep every Python lockfile (requirements.txt, poetry.lock, Pipfile.lock, pdm.lock, uv.lock, pyproject.toml) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the affected host could reach and re-image the host
If you had govpkg in a lockfile: audit outbound network traffic for HTTPS calls to telegra.ph from a Python interpreter or from the fake system service the payload installs. Legitimate application traffic to telegra.ph is rare in enterprise environments, so any hit is a strong govpkg indicator. Also audit systemctl list-units --all (Linux) or Get-Service (Windows) for any recently-created service unit that does not correspond to a known application - the payload persists as a fake system service. Rotate every credential the host could reach and re-image
If you had trongridev or trongridme in a lockfile: assume any Tron / TRX private key ever touched on that host is compromised - rotate the wallet, move funds to a fresh address generated on a clean host, and audit on-chain activity for unauthorized withdrawals. The legitimate PyPI package the pair typosquats is trongrid (Tron network Python SDK) - replace with the canonical package name and pin against the official tronprotocol/tronapi registry entry
Verify none of the 3 listed packages still resolve via your private mirror - internal Artifactory / Nexus / DevPI instances routinely cache tarballs and will keep serving the malicious versions after the public yank
Block egress to telegra.ph from server / CI environments unless there is a documented business need. Telegraph is a common dead-drop C2 platform for opportunistic PyPI malware (govpkg, and several earlier Ruby / Go samples) precisely because its content is trivial to publish and has plausible-deniability for a network defender to allow

References

Sources

pypi-2026-07-18-ghsa-malware-sweepBack to incidents Submit a correction

Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your requirements.txt All incidents