GitHub Advisory malware sweep — 3 PyPI packages retired 2026-07-18 (`govpkg` telegra.ph-C2 downloader + persistent fake-service; `trongridev`/`trongridme` Tron private-key exfil pair)

What happened

On 2026-07-18 GitHub's Advisory Database published 3 CWE-506 (Embedded Malicious Code) advisories against PyPI packages — the largest PyPI GHSA malware sweep in the recent July cadence. Every record uses the standard "any computer that has this package installed or running should be considered fully compromised — rotate all secrets from a different computer" boilerplate.

Cluster 1 — govpkg (telegra.ph-C2 downloader + fake-service persistence, OSSF 2026-07-govpkg campaign)

| Package | Versions | GHSA | Campaign tag | |---|---|---|---| | govpkg | 0.1.0, 0.2.0 | GHSA-f88m-xf6h-ph28 | 2026-07-govpkg |

The payload chain:

1. On pip install govpkg, the package silently downloads a native executable from an attacker-controlled URL.
2. The executable is installed as a fake system service — a Linux systemd unit or a Windows service registration named to look like a legitimate platform daemon, so the persistence survives reboot without raising the eyebrow of anyone glancing at the service list.
3. The daemon polls telegra.ph (the Telegram-owned anonymous-publishing platform) for next-stage instructions, encoded as ordinary long-form article text. Telegraph pages carry no distinctive TLS SNI, no rare DNS, and are almost never egress-blocked in enterprise environments — the same dead-drop C2 pattern that ChocoPoC uses against api.mapbox.com and the 2026-07-08 tailwind-core payload uses against script.google.com, but with an even lower-signal host.
4. Output and stolen data are written back to attacker-controlled Telegraph pages the same way, keeping the traffic shape completely one-directional as viewed by any per-host egress filter.

OpenSSF contributor kam193 is credited with the payload attribution on the GHSA record.

Cluster 2 — trongridev / trongridme Tron private-key exfil pair (OSSF 2025-04-tronix campaign)

| Package | Version | GHSA | Campaign tag | |---|---|---|---| | trongridev | 0.0.1 | GHSA-hx6g-6877-qvg8 | 2025-04-tronix | | trongridme | 0.0.1 | GHSA-4fhx-73c8-xxhv | 2025-04-tronix |

Both packages ship at a single 0.0.1 release and target the Tron / TRX blockchain — the name is a deliberate typosquat of the legitimate trongrid Python SDK. The stated purpose in the GHSA record is private-key exfiltration — any wallet key touched on a host that ran either package should be treated as leaked, funds moved to a fresh address, and on-chain activity audited for unauthorized withdrawals.

The 2025-04-tronix campaign has been a low-volume, high-persistence PyPI presence for over a year: OpenSSF has retired 100+ similarly-named trongrid* typosquats under this campaign identifier since April 2025. The pattern is always the same — one-off 0.0.1 releases, generic exfil payload, README often copied verbatim from a legitimate crypto SDK to defeat surface-level GitHub-README review.

Registry state

All 3 packages have been fully removed from PyPI (pypi.org/project/*/ returns 404 as of 2026-07-19). Private mirrors that cached the .tar.gz / .whl files during the publish window will keep serving them after the public yank — treat any lockfile hit as active malware regardless of what the public index currently returns.

Affected packages (3)

Impact

• Any host that installed any of the 3 packages below should be treated as fully compromised — every GHSA record uses the boilerplate CWE-506 "any computer that has this package installed or running should be considered fully compromised" language, and no patched version exists
• govpkg — telegra.ph-C2 downloader with fake-service persistence (2 versions, OSSF 2026-07-govpkg campaign): govpkg@0.1.0 and govpkg@0.2.0 silently download a native executable, disguise it as a system service (Linux systemd unit / Windows service registration) so the persistence survives reboot, and use telegra.ph (the Telegram-owned anonymous-publishing platform) as a command-and-control dead-drop. Telegraph pages look like ordinary long-form articles to a network egress filter, and the malware polls a specific Telegraph URL for next-stage instructions encoded as text — same dead-drop shape as ChocoPoC-on-Mapbox and tailwind-core-on-Google-Sheets but with an even lower-signal host (telegra.ph is not on most enterprise egress-block lists). Payload attribution credit: OpenSSF contributor kam193
• trongridev + trongridme — Tron private-key exfil pair (2 packages, OSSF 2025-04-tronix campaign): both packages ship at 0.0.1 and both are designed to exfiltrate cryptocurrency private keys, specifically targeting the Tron / TRX blockchain (the name typosquats the legitimate trongrid Python SDK). The advisories note "some packages additionally clone the readme of other, legit libraries" — a deception layer to defeat surface-level GitHub-README review. The 2025-04-tronix campaign has been a low-volume, high-persistence PyPI presence for over a year — OpenSSF has retired 100+ similarly-named trongrid* packages under this campaign identifier since April 2025
• None of the 3 packages have surviving version files on the public PyPI index — every version has been fully removed (pypi.org/project/*/ returns 404). Private PyPI mirrors (Artifactory, Nexus, pip-index-lockfile caches) that cached the .tar.gz or .whl files during the publish window WILL keep serving them after the public yank — lockfile hits on these names must be treated as active malware regardless of what pypi.org currently returns

What to do

1. 1Grep every Python lockfile (requirements.txt, poetry.lock, Pipfile.lock, pdm.lock, uv.lock, pyproject.toml) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the affected host could reach and re-image the host
2. 2If you had govpkg in a lockfile: audit outbound network traffic for HTTPS calls to telegra.ph from a Python interpreter or from the fake system service the payload installs. Legitimate application traffic to telegra.ph is rare in enterprise environments, so any hit is a strong govpkg indicator. Also audit systemctl list-units --all (Linux) or Get-Service (Windows) for any recently-created service unit that does not correspond to a known application — the payload persists as a fake system service. Rotate every credential the host could reach and re-image
3. 3If you had trongridev or trongridme in a lockfile: assume any Tron / TRX private key ever touched on that host is compromised — rotate the wallet, move funds to a fresh address generated on a clean host, and audit on-chain activity for unauthorized withdrawals. The legitimate PyPI package the pair typosquats is trongrid (Tron network Python SDK) — replace with the canonical package name and pin against the official tronprotocol/tronapi registry entry
4. 4Verify none of the 3 listed packages still resolve via your private mirror — internal Artifactory / Nexus / DevPI instances routinely cache tarballs and will keep serving the malicious versions after the public yank
5. 5Block egress to telegra.ph from server / CI environments unless there is a documented business need. Telegraph is a common dead-drop C2 platform for opportunistic PyPI malware (govpkg, and several earlier Ruby / Go samples) precisely because its content is trivial to publish and has plausible-deniability for a network defender to allow

References

• GitHub Advisory Database — recent PyPI malware advisories

  github.com
  GitHub
• GHSA-f88m-xf6h-ph28 — govpkg malware advisory (2026-07-govpkg campaign, telegra.ph C2)

  github.com
  GitHub
• GHSA-hx6g-6877-qvg8 — trongridev malware advisory (2025-04-tronix campaign)

  github.com
  GitHub
• GHSA-4fhx-73c8-xxhv — trongridme malware advisory (2025-04-tronix campaign)

  github.com
  GitHub