# GitHub Advisory PyPI malware sweep, 18 July 2026

> On 2026-07-18 GitHub's Advisory Database retired 3 CWE-506 PyPI malware advisories. Highlights: `govpkg` (versions 0.1.0, 0.2.0 - the OSSF-tagged `2026-07-govpkg` campaign) silently downloads a native executable, disguises it as a system service for persistence, and uses `telegra.ph` (Telegraph anonymous-publishing) as C2; and a `trongridev`/`trongridme` Tron private-key exfil pair (both v0.0.1) from the recurring OSSF `2025-04-tronix` campaign.

- Published: 2026-07-18
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: PyPI
- Scope: 3 packages, 4 compromised versions
- Tags: typosquat, infostealer, crypto-wallet-drain, obfuscation, dead-drop
- Also known as: 2026-07-18 GHSA PyPI sweep, 2026-07-govpkg campaign, 2025-04-tronix campaign
- Detected by: GitHub Advisory Database, OpenSSF Package Analysis
- Incident ID: pypi-2026-07-18-ghsa-malware-sweep

## Affected packages (3)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [govpkg](https://dependencywatch.io/package/pypi/govpkg) | PyPI | 0.1.0, 0.2.0 |
| [trongridev](https://dependencywatch.io/package/pypi/trongridev) | PyPI | 0.0.1 |
| [trongridme](https://dependencywatch.io/package/pypi/trongridme) | PyPI | 0.0.1 |

## What happened

On 2026-07-18 GitHub's Advisory Database published 3 CWE-506 (Embedded Malicious Code) advisories against PyPI packages - the largest PyPI GHSA malware sweep in the recent July cadence. Every record uses the standard "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" boilerplate.

## Cluster 1 - `govpkg` (telegra.ph-C2 downloader + fake-service persistence, OSSF `2026-07-govpkg` campaign)

| Package | Versions | GHSA | Campaign tag |
|---|---|---|---|
| `govpkg` | `0.1.0`, `0.2.0` | GHSA-f88m-xf6h-ph28 | `2026-07-govpkg` |

The payload chain:

1. On `pip install govpkg`, the package silently downloads a native executable from an attacker-controlled URL.
2. The executable is installed as a **fake system service** - a Linux systemd unit or a Windows service registration named to look like a legitimate platform daemon, so the persistence survives reboot without raising the eyebrow of anyone glancing at the service list.
3. The daemon polls `telegra.ph` (the Telegram-owned anonymous-publishing platform) for next-stage instructions, encoded as ordinary long-form article text. Telegraph pages carry no distinctive TLS SNI, no rare DNS, and are almost never egress-blocked in enterprise environments - the same dead-drop C2 pattern that [ChocoPoC](https://dependencywatch.io/incident/pypi-2026-07-01-chocopoc-frint-skytext) uses against `api.mapbox.com` and the [2026-07-08 tailwind-core payload](https://dependencywatch.io/incident/npm-2026-07-08-ghsa-malware-sweep) uses against `script.google.com`, but with an even lower-signal host.
4. Output and stolen data are written back to attacker-controlled Telegraph pages the same way, keeping the traffic shape completely one-directional as viewed by any per-host egress filter.

OpenSSF contributor `kam193` is credited with the payload attribution on the GHSA record.

## Cluster 2 - `trongridev` / `trongridme` Tron private-key exfil pair (OSSF `2025-04-tronix` campaign)

| Package | Version | GHSA | Campaign tag |
|---|---|---|---|
| `trongridev` | `0.0.1` | GHSA-hx6g-6877-qvg8 | `2025-04-tronix` |
| `trongridme` | `0.0.1` | GHSA-4fhx-73c8-xxhv | `2025-04-tronix` |

Both packages ship at a single `0.0.1` release and target the [Tron / TRX blockchain](https://tron.network) - the name is a deliberate typosquat of the legitimate `trongrid` Python SDK. The stated purpose in the GHSA record is **private-key exfiltration** - any wallet key touched on a host that ran either package should be treated as leaked, funds moved to a fresh address, and on-chain activity audited for unauthorized withdrawals.

The `2025-04-tronix` campaign has been a low-volume, high-persistence PyPI presence for over a year: OpenSSF has retired 100+ similarly-named `trongrid*` typosquats under this campaign identifier since April 2025. The pattern is always the same - one-off `0.0.1` releases, generic exfil payload, README often copied verbatim from a legitimate crypto SDK to defeat surface-level GitHub-README review.

## Registry state

All 3 packages have been fully removed from PyPI (`pypi.org/project/*/` returns 404 as of 2026-07-19). Private mirrors that cached the `.tar.gz` / `.whl` files during the publish window will keep serving them after the public yank - treat any lockfile hit as active malware regardless of what the public index currently returns.

## Impact

- Any host that installed any of the 3 packages below should be treated as fully compromised - every GHSA record uses the boilerplate CWE-506 "any computer that has this package installed or running should be considered fully compromised" language, and no patched version exists
- **`govpkg` - telegra.ph-C2 downloader with fake-service persistence** (2 versions, OSSF `2026-07-govpkg` campaign): `govpkg@0.1.0` and `govpkg@0.2.0` silently download a native executable, disguise it as a system service (Linux systemd unit / Windows service registration) so the persistence survives reboot, and use `telegra.ph` (the Telegram-owned anonymous-publishing platform) as a **command-and-control dead-drop**. Telegraph pages look like ordinary long-form articles to a network egress filter, and the malware polls a specific Telegraph URL for next-stage instructions encoded as text - same dead-drop shape as ChocoPoC-on-Mapbox and tailwind-core-on-Google-Sheets but with an even lower-signal host (telegra.ph is not on most enterprise egress-block lists). Payload attribution credit: OpenSSF contributor `kam193`
- **`trongridev` + `trongridme` - Tron private-key exfil pair** (2 packages, OSSF `2025-04-tronix` campaign): both packages ship at `0.0.1` and both are designed to exfiltrate cryptocurrency private keys, specifically targeting the Tron / TRX blockchain (the name typosquats the legitimate `trongrid` Python SDK). The advisories note "some packages additionally clone the readme of other, legit libraries" - a deception layer to defeat surface-level GitHub-README review. The `2025-04-tronix` campaign has been a low-volume, high-persistence PyPI presence for over a year - OpenSSF has retired 100+ similarly-named `trongrid*` packages under this campaign identifier since April 2025
- None of the 3 packages have surviving version files on the public PyPI index - every version has been fully removed (`pypi.org/project/*/` returns 404). Private PyPI mirrors (Artifactory, Nexus, pip-index-lockfile caches) that cached the `.tar.gz` or `.whl` files during the publish window WILL keep serving them after the public yank - lockfile hits on these names must be treated as active malware regardless of what `pypi.org` currently returns

## What to do

1. Grep every Python lockfile (`requirements.txt`, `poetry.lock`, `Pipfile.lock`, `pdm.lock`, `uv.lock`, `pyproject.toml`) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the affected host could reach and re-image the host
2. **If you had `govpkg` in a lockfile**: audit outbound network traffic for HTTPS calls to `telegra.ph` from a Python interpreter or from the fake system service the payload installs. Legitimate application traffic to `telegra.ph` is rare in enterprise environments, so any hit is a strong `govpkg` indicator. Also audit `systemctl list-units --all` (Linux) or `Get-Service` (Windows) for any recently-created service unit that does not correspond to a known application - the payload persists as a fake system service. Rotate every credential the host could reach and re-image
3. **If you had `trongridev` or `trongridme` in a lockfile**: assume any Tron / TRX private key ever touched on that host is compromised - rotate the wallet, move funds to a fresh address generated on a clean host, and audit on-chain activity for unauthorized withdrawals. The legitimate PyPI package the pair typosquats is `trongrid` (Tron network Python SDK) - replace with the canonical package name and pin against the official [tronprotocol/tronapi](https://github.com/tronprotocol/tronapi) registry entry
4. Verify none of the 3 listed packages still resolve via your private mirror - internal Artifactory / Nexus / DevPI instances routinely cache tarballs and will keep serving the malicious versions after the public yank
5. Block egress to `telegra.ph` from server / CI environments unless there is a documented business need. Telegraph is a common dead-drop C2 platform for opportunistic PyPI malware (govpkg, and several earlier Ruby / Go samples) precisely because its content is trivial to publish and has plausible-deniability for a network defender to allow

## Check your own dependencies

- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent PyPI malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub
- [GHSA-f88m-xf6h-ph28 - govpkg malware advisory (2026-07-govpkg campaign, telegra.ph C2)](https://github.com/advisories/GHSA-f88m-xf6h-ph28) - GitHub
- [GHSA-hx6g-6877-qvg8 - trongridev malware advisory (2025-04-tronix campaign)](https://github.com/advisories/GHSA-hx6g-6877-qvg8) - GitHub
- [GHSA-4fhx-73c8-xxhv - trongridme malware advisory (2025-04-tronix campaign)](https://github.com/advisories/GHSA-4fhx-73c8-xxhv) - GitHub

---

Canonical page: https://dependencywatch.io/incident/pypi-2026-07-18-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/pypi-2026-07-18-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).