# GitHub Advisory PyPI CWE-506 sweep - 7-package 2026-07-28 batch (`karpatkit`/`karpatkey` dep-confusion pair against Karpatkey DAO tooling, `dev-helper-bg` + `cfgzen` infostealer siblings, `mrmustard` Xanadu-quantum-lib typosquat, `vtranalytic` Telegram RAT, `govapkg` fake-Go-doc-client with systemd persistence)

> GHSA published 7 new PyPI CWE-506 advisories on 2026-07-28: `karpatkit`/`karpatkey` Karpatkey DAO dep-confusion pair, `dev-helper-bg` + `cfgzen` infostealer siblings, `mrmustard@0.7.4` Xanadu typosquat, `vtranalytic@9.0.1` Telegram RAT, `govapkg@0.1.0` fake Go doc client with systemd persistence.

- Published: 2026-07-28
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: PyPI
- Scope: 7 packages, 17 compromised versions
- Tags: typosquat, dependency-confusion, credential-theft, infostealer, crypto-wallet-drain
- Also known as: 2026-07-28 GHSA PyPI batch, Karpatkey DAO dep-confusion
- Detected by: GitHub Advisory Database, OpenSSF Package Analysis
- Incident ID: pypi-2026-07-28-ghsa-malware-sweep

## Affected packages (7)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [cfgzen](https://dependencywatch.io/package/pypi/cfgzen) | PyPI | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6 |
| [dev-helper-bg](https://dependencywatch.io/package/pypi/dev-helper-bg) | PyPI | 0.1.3, 0.1.4, 0.1.6, 0.1.7 |
| [govapkg](https://dependencywatch.io/package/pypi/govapkg) | PyPI | 0.1.0 |
| [karpatkey](https://dependencywatch.io/package/pypi/karpatkey) | PyPI | 2.1.1 |
| [karpatkit](https://dependencywatch.io/package/pypi/karpatkit) | PyPI | 2.1.0, 2.1.1 |
| [mrmustard](https://dependencywatch.io/package/pypi/mrmustard) | PyPI | 0.7.4 |
| [vtranalytic](https://dependencywatch.io/package/pypi/vtranalytic) | PyPI | 9.0.1 |

## What happened

On 2026-07-28, the GitHub Advisory Database published **7 new PyPI CWE-506 (Embedded Malicious Code) advisories** for coordinated malicious uploads.

## Cluster A - Karpatkey DAO dep-confusion pair

| Package | Versions | Notes |
|---|---|---|
| `karpatkit` | `2.1.0`, `2.1.1` | dep-confusion against Karpatkey internal tooling |
| `karpatkey` | `2.1.1` | dep-confusion against the DAO's namesake package |

Both exfiltrate SSH keys, AWS + GCP credentials, cryptocurrency wallet files, shell history, and `~/.env*` on import. Karpatkey is a DAO treasury-management collective - the target is DAO-treasury private keys and multisig signer machines. The legitimate `karpatkey` distribution publishes to a private index; the malicious uploads exploit the public-PyPI-preference default in `pip`.

## Cluster B - infostealer sibling pair

| Package | Versions | Notes |
|---|---|---|
| `dev-helper-bg` | `0.1.3`, `0.1.4`, `0.1.6`, `0.1.7` | remotely-controlled encrypted code, Telegram exfil |
| `cfgzen` | `1.0.0`, `1.0.1`, `1.0.2`, `1.0.3`, `1.0.4`, `1.0.5`, `1.0.6` | encrypted-remote-executable + sandbox detection |

Multiple published versions across both packages indicate active operator iteration through the malicious window. Shared behavioural fingerprints (encrypted remote payload, exfil kit) suggest same operator using different distribution names to weather partial takedowns.

## Cluster C - Xanadu Quantum typosquat

| Package | Version | Notes |
|---|---|---|
| `mrmustard` | `0.7.4` | typosquat of Xanadu quantum-photonics library |

Exfiltrates SSH keys, AWS credentials, and environment variables via a background thread. Persistence is disguised as a "tensorflow hardware compatibility check" - the disguise is deliberately shaped to blend with legitimate ML-tooling install noise so verbose-mode `pip install` output review does not flag it.

## Cluster D - Telegram RAT

| Package | Version | Notes |
|---|---|---|
| `vtranalytic` | `9.0.1` | Telegram-bot-controlled RAT |

Provides an attacker-controlled Telegram bot with arbitrary command execution and credential-theft primitives. The inflated `9.x` major version on a package with no version-1-through-8 history is a strong dep-confusion signal.

## Cluster E - Fake Go doc client with systemd persistence

| Package | Version | Notes |
|---|---|---|
| `govapkg` | `0.1.0` | fake Go doc client, systemd desktop service persistence |

Masquerades as a Go documentation client. On import, downloads and executes a remote binary; establishes persistence by dropping a `.desktop` service unit into `~/.local/share/applications` disguised as a legitimate desktop entry - survives reboot on Linux desktop hosts.

## Registry state

All 7 packages yanked from PyPI. Private mirrors (devpi, Nexus, Artifactory) that cached wheels BEFORE the yank WILL keep serving the malicious versions - verify your mirror does not.

## Impact

- Any host with any of these 7 PyPI packages installed at the listed versions should be treated as fully compromised - every advisory carries the CWE-506 boilerplate, and no patched versions exist
- **`karpatkit@2.1.0`/`2.1.1` + `karpatkey@2.1.1`**: coordinated dep-confusion pair targeting the Karpatkey DAO treasury-tooling scope. Both exfil SSH keys, AWS + GCP credentials, cryptocurrency wallet files, and shell history at import time. The `karpatkey` legitimate package publishes to a private index - the malicious public-PyPI upload is a textbook dep-confusion primitive
- **`dev-helper-bg@0.1.3`/`0.1.4`/`0.1.6`/`0.1.7`**: executes remotely-controlled encrypted code on import; exfiltrates files via Telegram bot. Multiple published versions suggest active operator iteration
- **`cfgzen@1.0.0`-`1.0.6`**: infostealer that downloads and executes encrypted remote executables while detecting sandbox environments (VM check, debugger check). Seven published versions in the malicious window
- **`mrmustard@0.7.4`**: typosquat of Xanadu's legitimate `mrmustard` quantum-photonics library. Exfiltrates SSH keys, AWS credentials, and environment variables via a background thread disguised as a "tensorflow hardware compatibility check" - the disguise is deliberately shaped to survive `pip install` verbose output review
- **`vtranalytic@9.0.1`**: Telegram-bot-controlled remote administration tool with arbitrary command execution and credential-theft primitives. Inflated `9.x` major version is a dep-confusion signal
- **`govapkg@0.1.0`**: masquerades as a Go documentation client; on import downloads and executes a remote binary and establishes persistence through a fake `systemd` desktop service unit in `~/.local/share/applications`
- All 7 packages remain yanked / removed from PyPI public listings, but private PyPI mirrors (devpi, Nexus, Artifactory) that cached wheels BEFORE the yank WILL keep serving the malicious versions

## What to do

1. Grep every Python requirements file (`requirements.txt`, `pyproject.toml`, `poetry.lock`, `Pipfile.lock`, `uv.lock`, `constraints.txt`) for each package name in the packages map below
2. **`karpatkit` / `karpatkey`**: any Karpatkey DAO integration must configure `pip install --index-url` scoped to the private index, or use `pip install --require-hashes` with pinned wheel hashes. If your lockfile ever resolved these names from public PyPI, rotate every SSH key, AWS access key, GCP service-account key, browser wallet extension seed, and multisig signer key reachable from the host that ran `pip install`
3. **`dev-helper-bg` / `cfgzen`**: any hit at any listed version is a compromise - the infostealer runs on import, not just install. Rotate everything the interpreter's user could reach and re-image the developer / build host
4. **`mrmustard`**: verify the `mrmustard` your projects install comes from the legitimate Xanadu upload (`XanaduAI` PyPI account). The malicious `0.7.4` is a typosquat - check whether the legitimate library reached `0.7.4` before pinning; if uncertain, pin to a known-good older version like `0.6.x`
5. **`vtranalytic`, `govapkg`**: uncommon names, but any pin at the listed versions is a full compromise. `govapkg` writes a `.desktop` file to `~/.local/share/applications` for persistence - delete any unrecognised entry there when remediating
6. Configure `pip install --no-cache-dir` in ephemeral CI images so a poisoned wheel cache from a prior run cannot re-infect a supposedly-clean build
7. Verify none of the 7 listed packages still resolves via your private mirror - internal devpi / Nexus / Artifactory instances routinely cache wheels and will keep serving the original versions after the public yank

## Check your own dependencies

- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent PyPI malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub
- [GHSA-7qg7-6pg7-g63q - karpatkit malware advisory](https://github.com/advisories/GHSA-7qg7-6pg7-g63q) - GitHub
- [GHSA-v497-gp55-jwxm - karpatkey malware advisory](https://github.com/advisories/GHSA-v497-gp55-jwxm) - GitHub
- [GHSA-pcf6-hwj2-m3vw - dev-helper-bg malware advisory](https://github.com/advisories/GHSA-pcf6-hwj2-m3vw) - GitHub
- [GHSA-r2w6-7pgv-644h - cfgzen malware advisory](https://github.com/advisories/GHSA-r2w6-7pgv-644h) - GitHub
- [GHSA-7h9m-3hvr-pjg2 - mrmustard malware advisory](https://github.com/advisories/GHSA-7h9m-3hvr-pjg2) - GitHub
- [GHSA-29jr-g2qh-hj97 - vtranalytic malware advisory](https://github.com/advisories/GHSA-29jr-g2qh-hj97) - GitHub
- [GHSA-pxxf-hj67-hjm5 - govapkg malware advisory](https://github.com/advisories/GHSA-pxxf-hj67-hjm5) - GitHub

---

Canonical page: https://dependencywatch.io/incident/pypi-2026-07-28-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/pypi-2026-07-28-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).