GitHub Advisory PyPI CWE-506 sweep - 7-package 2026-07-28 batch (`karpatkit`/`karpatkey` dep-confusion pair against Karpatkey DAO tooling, `dev-helper-bg` + `cfgzen` infostealer siblings, `mrmustard` Xanadu-quantum-lib typosquat, `vtranalytic` Telegram RAT, `govapkg` fake-Go-doc-client with systemd persistence)

What happened

On 2026-07-28, the GitHub Advisory Database published 7 new PyPI CWE-506 (Embedded Malicious Code) advisories for coordinated malicious uploads.

Cluster A - Karpatkey DAO dep-confusion pair

| Package | Versions | Notes | |---|---|---| | karpatkit | 2.1.0, 2.1.1 | dep-confusion against Karpatkey internal tooling | | karpatkey | 2.1.1 | dep-confusion against the DAO's namesake package |

Both exfiltrate SSH keys, AWS + GCP credentials, cryptocurrency wallet files, shell history, and ~/.env* on import. Karpatkey is a DAO treasury-management collective - the target is DAO-treasury private keys and multisig signer machines. The legitimate karpatkey distribution publishes to a private index; the malicious uploads exploit the public-PyPI-preference default in pip.

Cluster B - infostealer sibling pair

| Package | Versions | Notes | |---|---|---| | dev-helper-bg | 0.1.3, 0.1.4, 0.1.6, 0.1.7 | remotely-controlled encrypted code, Telegram exfil | | cfgzen | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6 | encrypted-remote-executable + sandbox detection |

Multiple published versions across both packages indicate active operator iteration through the malicious window. Shared behavioural fingerprints (encrypted remote payload, exfil kit) suggest same operator using different distribution names to weather partial takedowns.

Cluster C - Xanadu Quantum typosquat

| Package | Version | Notes | |---|---|---| | mrmustard | 0.7.4 | typosquat of Xanadu quantum-photonics library |

Exfiltrates SSH keys, AWS credentials, and environment variables via a background thread. Persistence is disguised as a "tensorflow hardware compatibility check" - the disguise is deliberately shaped to blend with legitimate ML-tooling install noise so verbose-mode pip install output review does not flag it.

Cluster D - Telegram RAT

| Package | Version | Notes | |---|---|---| | vtranalytic | 9.0.1 | Telegram-bot-controlled RAT |

Provides an attacker-controlled Telegram bot with arbitrary command execution and credential-theft primitives. The inflated 9.x major version on a package with no version-1-through-8 history is a strong dep-confusion signal.

Cluster E - Fake Go doc client with systemd persistence

| Package | Version | Notes | |---|---|---| | govapkg | 0.1.0 | fake Go doc client, systemd desktop service persistence |

Masquerades as a Go documentation client. On import, downloads and executes a remote binary; establishes persistence by dropping a .desktop service unit into ~/.local/share/applications disguised as a legitimate desktop entry - survives reboot on Linux desktop hosts.

Registry state

All 7 packages yanked from PyPI. Private mirrors (devpi, Nexus, Artifactory) that cached wheels BEFORE the yank WILL keep serving the malicious versions - verify your mirror does not.

Affected packages (7)

Impact

• Any host with any of these 7 PyPI packages installed at the listed versions should be treated as fully compromised - every advisory carries the CWE-506 boilerplate, and no patched versions exist
• karpatkit@2.1.0/2.1.1 + karpatkey@2.1.1: coordinated dep-confusion pair targeting the Karpatkey DAO treasury-tooling scope. Both exfil SSH keys, AWS + GCP credentials, cryptocurrency wallet files, and shell history at import time. The karpatkey legitimate package publishes to a private index - the malicious public-PyPI upload is a textbook dep-confusion primitive
• dev-helper-bg@0.1.3/0.1.4/0.1.6/0.1.7: executes remotely-controlled encrypted code on import; exfiltrates files via Telegram bot. Multiple published versions suggest active operator iteration
• cfgzen@1.0.0-1.0.6: infostealer that downloads and executes encrypted remote executables while detecting sandbox environments (VM check, debugger check). Seven published versions in the malicious window
• mrmustard@0.7.4: typosquat of Xanadu's legitimate mrmustard quantum-photonics library. Exfiltrates SSH keys, AWS credentials, and environment variables via a background thread disguised as a "tensorflow hardware compatibility check" - the disguise is deliberately shaped to survive pip install verbose output review
• vtranalytic@9.0.1: Telegram-bot-controlled remote administration tool with arbitrary command execution and credential-theft primitives. Inflated 9.x major version is a dep-confusion signal
• govapkg@0.1.0: masquerades as a Go documentation client; on import downloads and executes a remote binary and establishes persistence through a fake systemd desktop service unit in ~/.local/share/applications
• All 7 packages remain yanked / removed from PyPI public listings, but private PyPI mirrors (devpi, Nexus, Artifactory) that cached wheels BEFORE the yank WILL keep serving the malicious versions

What to do

1. 1Grep every Python requirements file (requirements.txt, pyproject.toml, poetry.lock, Pipfile.lock, uv.lock, constraints.txt) for each package name in the packages map below
2. 2karpatkit / karpatkey: any Karpatkey DAO integration must configure pip install --index-url scoped to the private index, or use pip install --require-hashes with pinned wheel hashes. If your lockfile ever resolved these names from public PyPI, rotate every SSH key, AWS access key, GCP service-account key, browser wallet extension seed, and multisig signer key reachable from the host that ran pip install
3. 3dev-helper-bg / cfgzen: any hit at any listed version is a compromise - the infostealer runs on import, not just install. Rotate everything the interpreter's user could reach and re-image the developer / build host
4. 4mrmustard: verify the mrmustard your projects install comes from the legitimate Xanadu upload (XanaduAI PyPI account). The malicious 0.7.4 is a typosquat - check whether the legitimate library reached 0.7.4 before pinning; if uncertain, pin to a known-good older version like 0.6.x
5. 5vtranalytic, govapkg: uncommon names, but any pin at the listed versions is a full compromise. govapkg writes a .desktop file to ~/.local/share/applications for persistence - delete any unrecognised entry there when remediating
6. 6Configure pip install --no-cache-dir in ephemeral CI images so a poisoned wheel cache from a prior run cannot re-infect a supposedly-clean build
7. 7Verify none of the 7 listed packages still resolves via your private mirror - internal devpi / Nexus / Artifactory instances routinely cache wheels and will keep serving the original versions after the public yank

References

• GitHub Advisory Database - recent PyPI malware advisories

  github.com
  GitHub
• GHSA-7qg7-6pg7-g63q - karpatkit malware advisory

  github.com
  GitHub
• GHSA-v497-gp55-jwxm - karpatkey malware advisory

  github.com
  GitHub
• GHSA-pcf6-hwj2-m3vw - dev-helper-bg malware advisory

  github.com
  GitHub
• GHSA-r2w6-7pgv-644h - cfgzen malware advisory

  github.com
  GitHub
• GHSA-7h9m-3hvr-pjg2 - mrmustard malware advisory

  github.com
  GitHub
• GHSA-29jr-g2qh-hj97 - vtranalytic malware advisory

  github.com
  GitHub
• GHSA-pxxf-hj67-hjm5 - govapkg malware advisory

  github.com
  GitHub