GitHub Advisory PyPI CWE-506 sweep - 14-package 2026-07-30/07-31 batch (`ml-*-shared` env-var exfil, `ai-perf-toolkit` + `mcp-search-server` cryptominer pair, `phabricator-client@99.x` dep-confusion, plus late-07-31 `2026-07-cognikit` DPRK Contagious Interview cluster and `reguestsc` salatstealer)

What happened

On 2026-07-30 and 2026-07-31, the GitHub Advisory Database published 14 new PyPI CWE-506 (Embedded Malicious Code) advisories - 3 dated 2026-07-30 and 11 dated 2026-07-31. This module catalogues that batch. This entry was updated 2026-08-01 to add the late-07-31 DPRK Contagious Interview 2026-07-cognikit cluster (6 packages) and the reguestsc salatstealer typosquat (1 package) that landed after the initial 07-31 ingest snapshot.

Unlike the recent all-versions boilerplate npm sweeps, every PyPI advisory in this batch carries specific-behaviour prose (install-time env-var exfil, import-time cryptomining, dep-confusion probe, phone-home for miner delivery, DPRK crypto-wallet-drainer / infostealer, downloaded-payload infostealer) - indicating GHSA / OpenSSF Package Analysis observed the packages in dynamic analysis rather than relying only on registry-side static-metadata flags. That specificity lets defenders scope the blast radius per-cluster rather than assume worst-case for all 14.

Cluster A - ml-*-shared install-time env-var exfil kit (4 packages, 2026-07-31)

| Package | Versions | Notes | |---|---|---| | ml-shared | 6.3.0, 8.8.0 | env-var exfil | | ml-fdbk-shared | 1.0.0, 2.3.1 | env-var exfil (feedback-loop namespace) | | ml-nps-shared | 6.0.3, 8.2.3 | env-var exfil (NPS = Net Promoter Score?) | | ml-data-shared | 12.0.1, 16.0.1 | env-var exfil |

Every advisory reuses the identical boilerplate: "during installation, package exfiltrates basic info and all environmental variables … captures system data like IP addresses and usernames." Same day, same wording, same behaviour, same "-shared" naming convention across 4 packages - unambiguously one operator running an install-time env-var exfil kit against ML-tooling namespaces. The version pairs (each package flagged at 2 non-adjacent versions rather than a single release) suggest the operator maintained the packages for a period to blend into normal release cadence before flagging.

The ml-*-shared naming is a classic dep-confusion probe pattern against internal ML-platform library namespaces at organisations that maintain a shared ML tooling package (e.g. <company>-ml-shared internal Python libraries). CI environments that inject cloud / LLM / ML-platform API keys via env vars into pip install are the primary exposure - a single pip install ml-shared in a CI job with OPENAI_API_KEY / HUGGINGFACE_TOKEN / AWS_ACCESS_KEY_ID in the environment exfiltrates all of them.

Cluster B - ai-perf-toolkit import-time cryptominer (1 package, 2026-07-30)

| Package | Versions | Notes | |---|---|---| | ai-perf-toolkit | <= 2.4.2 (representative 2.4.2 recorded) | import-time cryptominer for hardcoded wallet |

GHSA advisory: "During import, the package starts cryptomining for a hardcoded wallet. The mining software has to already be installed." Import-time (not install-time) trigger - activates whenever any Python code does import ai_perf_toolkit, so a single dev-machine test-import is enough to detonate on any host that also has the mining binary pre-installed. The "mining software has to already be installed" qualifier means the payload is a launcher, not a full miner - reduces malware footprint (no need to smuggle a large binary through pip) but requires a co-located miner install, which suggests Cluster C mcp-search-server as the paired dropper.

Cluster C - mcp-search-server cryptominer phone-home dropper (1 package, 2026-07-30)

| Package | Versions | Notes | |---|---|---| | mcp-search-server | 1.0.0, 2.0.0, 2.0.1 | "share compute swarm" phone-home, prep for cryptominer delivery |

GHSA advisory: implements hidden "phone home" functionality under the guise of a "share compute swarm" feature, with evidence suggesting preparation for deploying cryptocurrency miners. Same-day publish as ai-perf-toolkit and same cryptomining target class - probable same operator: mcp-search-server phone-home confirms a live host, ai-perf-toolkit is the payload-delivery vector once the miner binary lands. The mcp-* naming targets the Model Context Protocol namespace (Anthropic AI-agent tooling) - an active landgrab area with a burst of typosquats through 2026 Q2/Q3.

Cluster D - phabricator-client@99.x dep-confusion probe (1 package, 5 versions, 2026-07-30)

| Package | Versions | Notes | |---|---|---| | phabricator-client | 99.0.0, 99.0.1, 99.0.2, 99.0.3, 99.0.4 | host-info exfil, dep-confusion via artificially-high version numbers |

GHSA advisory: "exfiltrates basic information about the host during installation and has no legitimate functionality." Version numbers starting at 99.0.0 is the canonical dependency-confusion pattern - attacker publishes with an artificially high version number so that pip's resolver preferentially picks the public malicious package over the target organisation's private phabricator-client internal library.

Phabricator is a defunct-but-still-widely-installed code-review platform (Facebook / Meta origin, spun out to independent Phorge fork after Phabricator shutdown, still maintained internally at multiple engineering orgs including derivative deployments at other companies). This is a targeted probe against companies still maintaining internal Phabricator integration libraries - a smaller target surface than a broad-scatter typosquat, but the hit-rate is high on any org that still runs Phabricator infrastructure.

Cluster E - DPRK Contagious Interview 2026-07-cognikit cluster (6 packages, all = 0.1.2, late 2026-07-31)

| Package | Version | Role | |---|---|---| | aiprepkit | 0.1.2 | fake AI-tooling wrapper, pulls cognikit/aiassistcore | | catalogai | 0.1.2 | fake AI-tooling wrapper, pulls C2 dependencies | | cognikit | 0.1.2 | carrier - C2 config + malicious payload | | aiassistcore | 0.1.2 | carrier - RAT / remote-command-exec payload | | aichannel | 0.1.2 | fake AI-tooling wrapper | | ailaunchkit | 0.1.2 | fake AI-tooling wrapper |

Every GHSA advisory in this cluster explicitly names it as North Korea "Contagious Interview" activity. The malware performs: crypto-wallet address replacement (clipboard hijack), browser data exfiltration, keylogging, clipboard modification, RAT command execution, and persistence via malicious browser extensions.

The cluster uses a carrier/wrapper pairing pattern: aiprepkit/catalogai/aichannel/ailaunchkit provide plausible fake AI-tooling functionality on the surface and pull cognikit/aiassistcore as transitive dependencies - the latter two carry the actual C2 config and payload. All 6 packages share the = 0.1.2 version pin and were published within a tight window on late 07-31, indicating one coordinated drop.

This is the same DPRK operation catalogued in multi-2026-04-07-contagious-interview-5-ecosystems, npm-2026-02-27-stegabin-contagious-interview, multi-2026-02-11-lazarus-graphalgo, and pypi-2026-07-01-chocopoc-frint-skytext - new campaign wave, this one targeting the Python AI-tooling namespace (aiprep / cognit / aichannel / ailaunchkit are all plausibly-named fake tools the operator would present to a Contagious Interview target as "the assessment codebase").

Cluster F - reguestsc salatstealer typosquat (1 package, = 2.34.2, 2026-07-31)

| Package | Version | Notes | |---|---|---| | reguestsc | 2.34.2 | requests typosquat, on-import remote-binary download → salatstealer infostealer |

GHSA advisory: "Downloads and executes a remote executable", payload identified as salatstealer - a Go-based Windows infostealer that harvests browser credentials, Discord tokens, crypto-wallet artefacts, and Telegram sessions. Version 2.34.2 mirrors the current legitimate requests release, priming the typo to catch developers version-pinning to requests==2.34.2.

The salatstealer family has been active across npm and PyPI through 2026 as a commodity-payload delivered by opportunistic typosquats - this is the first requests-family typosquat GHSA has flagged for it in the current wave.

Registry state

All 14 packages security-yanked from PyPI during the 2026-07-30 / 07-31 takedown. Original version tarballs are no longer resolvable on the public index, but private mirrors (devpi, Artifactory, Nexus, AWS CodeArtifact, Google Artifact Registry) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

Related tracked activity

• Cluster C mcp-* namespace targeting is consistent with the 2026-07 MCP-namespace typosquat activity around npm-2026-07-30-ghsa-malware-sweep and the earlier multi-2026-04-29-promptmink-validate-sdk MCP-adjacent campaign.
• Cluster D phabricator-client@99.x fits the broader 2026 dep-confusion probe wave - same technique as npm-2026-06-29-internal-scope-dep-confusion-cluster and pypi-2026-07-21-ghsa-mass-backfill.
• Cluster E is attributed to DPRK Contagious Interview - same threat actor tracked in multi-2026-02-11-lazarus-graphalgo, npm-2026-02-27-stegabin-contagious-interview, multi-2026-04-07-contagious-interview-5-ecosystems, pypi-2026-07-01-chocopoc-frint-skytext, and npm-2026-07-03-jfrog-lazarus-rollup-polyfill-ottercookie.
• Cluster F reguestsc salatstealer echoes the salatstealer-payload pattern used across several 2026 typosquat drops - commodity payload / opportunistic delivery.

Affected packages (14)

Impact

• Any host that installed any of the 7 PyPI packages listed below should be treated as fully compromised - every GHSA record carries the CWE-506 "malicious code" classification with no patched version
• *Cluster A - `ml--shared env-var exfil kit** (4 packages, all 2026-07-31): ml-shared@6.3.0,8.8.0, ml-fdbk-shared@1.0.0,2.3.1, ml-nps-shared@6.0.3,8.2.3, ml-data-shared@12.0.1,16.0.1`. Every advisory reuses the same identical boilerplate: "during installation, package exfiltrates basic info and all environmental variables … captures system data like IP addresses and usernames." Same day, same wording, same behaviour, same "-shared" naming convention across 4 packages - unambiguously one operator running an install-time env-var exfil kit against ML-tooling namespaces. The version pairs (each package flagged at 2 non-adjacent versions) suggest the operator maintained the packages for a period to blend into normal release cadence before flagging
• Cluster B - ai-perf-toolkit cryptominer (1 package, versions <= 2.4.2, 2026-07-30): ai-perf-toolkit. GHSA advisory: "during import, the package starts cryptomining for a hardcoded wallet. The mining software has to already be installed." Import-time (not install-time) trigger - activates whenever any Python code does import ai_perf_toolkit, so a single dev-machine test-import is enough to detonate on any host that also has the mining binary pre-installed
• Cluster C - mcp-search-server cryptominer phone-home (1 package, versions 1.0.0, 2.0.0, 2.0.1, 2026-07-30): mcp-search-server. GHSA advisory: implements hidden "phone home" functionality under the guise of a "share compute swarm" feature, with evidence suggesting preparation for deploying cryptocurrency miners. Same-day publish as ai-perf-toolkit and same cryptomining target class - probably the same operator: ai-perf-toolkit is the payload-delivery vector once mcp-search-server phone-home confirms a live host. The mcp-* naming targets the Model Context Protocol namespace (Anthropic AI-agent tooling), an active landgrab area
• Cluster D - phabricator-client@99.0.0–99.0.4 dep-confusion probe (1 package, 5 versions, 2026-07-30): phabricator-client. Version numbers starting at 99.0.0 is the canonical dependency-confusion pattern - attacker publishes with an artificially high version number so that pip's resolver preferentially picks the public malicious package over the target organisation's private phabricator-client internal library. Phabricator is a defunct-but-still-widely-installed code-review platform (Facebook / Meta and derivative deployments at other engineering orgs) - this is a targeted probe against companies still maintaining internal Phabricator integration libraries
• Cluster E - DPRK Contagious Interview 2026-07-cognikit cluster (6 packages, all = 0.1.2, late 2026-07-31): aiprepkit, catalogai, cognikit, aiassistcore, aichannel, ailaunchkit. Every advisory explicitly names this as North Korea "Contagious Interview" activity: crypto-wallet address replacement, browser data exfil, keylogging, clipboard modification, RAT, persistence via malicious browser extensions, remote command execution. Package pairing: aiprepkit/catalogai/aichannel/ailaunchkit provide fake AI-tooling functionality and pull cognikit/aiassistcore as dependencies - the latter carry the C2 config and malicious payload. This is the same DPRK operation catalogued in multi-2026-04-07-contagious-interview-5-ecosystems, npm-2026-02-27-stegabin-contagious-interview, and pypi-2026-07-01-chocopoc-frint-skytext - new campaign wave targeting Python AI-tooling namespace via fake job assessments
• Cluster F - reguestsc salatstealer typosquat (1 package, = 2.34.2, 2026-07-31): reguestsc is a requests typosquat (extra e and c) that on import downloads and executes a remote binary identified by researchers as salatstealer - a Go-based Windows infostealer that harvests browser credentials, discord tokens, crypto-wallet artefacts, and Telegram sessions. Version 2.34.2 matches the current legitimate requests release, priming the typo to catch developers pinning to a specific version
• None of the 14 packages retain original tarballs on PyPI - all yanked during the takedown. Private mirrors that cached tarballs BEFORE the takedown WILL keep serving the original versions

What to do

1. 1Grep every lockfile (requirements.txt, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda-lock.yml) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the affected process could reach and re-image the host
2. 2*Cluster A (`ml--shared` env-var exfil kit)**: any lockfile hit at any version: rotate every environment-injected credential (LLM API keys, cloud provider secrets, HuggingFace / W&B / MLflow tokens, database URLs, S3 access keys) that the process had access to at install time. The advisory boilerplate is specifically install-time env-var scraping - CI environments injecting secrets via env vars into pip install are the primary exposure
3. 3Cluster B (ai-perf-toolkit cryptominer): any lockfile hit at any version <= 2.4.2: check the host for pre-installed mining binaries (xmrig, ethminer, minergate) and rotate any cloud-provider billing / VM console credentials from the affected host - an unattended cryptominer on a paid VM burns cash and often triggers cloud abuse-detection lockouts
4. 4Cluster C (mcp-search-server): any lockfile hit at any of 1.0.0, 2.0.0, 2.0.1: audit outbound network for the phone-home C2 channel and pull the hosts off the network before mining-binary payload delivery completes. If the host also has ai-perf-toolkit, treat as active cryptominer infection
5. 5Cluster D (phabricator-client@99.x): configure your private PyPI mirror (Artifactory, Nexus, devpi, Google Artifact Registry, AWS CodeArtifact) with explicit package-name allow-lists for internal packages so pip never falls through to the public registry for phabricator-client and related internal-tool names. Audit any recent CI runs that resolved phabricator-client against the public registry
6. 6Cluster E (DPRK Contagious Interview 2026-07-cognikit): any hit on any of the 6 packages: treat the host as an active DPRK Contagious Interview infection - rotate every crypto-wallet seed phrase, exchange API key, browser-stored credential, Telegram session, and Discord token accessible from the affected host. Move funds via a clean device BEFORE any rotation. Remove any recently-installed browser extensions (persistence vector), clear extension storage, and reset browser profiles from a known-clean device. Look for outbound traffic to attacker C2 endpoints listed in Socket / Phylum / Wiz Contagious Interview writeups. This is a targeted nation-state operation - a hit at a developer workstation is grounds for a full DFIR sweep, not just a package removal
7. 7Cluster F (reguestsc salatstealer): any lockfile or pip freeze hit on reguestsc at 2.34.2: treat as full Windows workstation compromise. Rotate every browser-stored credential, Discord token, Telegram session, and inspect every crypto-wallet balance. Confirm the intended package name is requests (no e, no c) and re-install from a verified requirement pin
8. 8For all PyPI installs in CI, prefer pip install --require-hashes with a fully-hashed requirements.txt or Poetry / uv / pdm lockfiles that pin resolved hashes - hash-pinning defeats replacement of a resolved-to package with a same-name malicious package after initial resolution
9. 9Verify none of the 14 listed packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

• GitHub Advisory Database - recent PyPI malware advisories

  github.com
  GitHub
• GHSA-r6hm-wcqx-r255 - ml-shared malware advisory

  github.com
  GitHub
• GHSA-hf8q-5jww-9c56 - ml-fdbk-shared malware advisory

  github.com
  GitHub
• GHSA-fm92-h663-5c62 - ml-nps-shared malware advisory

  github.com
  GitHub
• GHSA-cqgc-q24x-3g9m - ml-data-shared malware advisory

  github.com
  GitHub
• GHSA-9p9m-j35v-j8cp - ai-perf-toolkit malware advisory

  github.com
  GitHub
• GHSA-3rhm-6v7p-whrg - mcp-search-server malware advisory

  github.com
  GitHub
• GHSA-pph4-3958-ffpq - phabricator-client malware advisory

  github.com
  GitHub
• GHSA-wg77-wqj2-3733 - aiprepkit malware advisory (Contagious Interview)

  github.com
  GitHub
• GHSA-6cqw-65hg-qqm3 - catalogai malware advisory (Contagious Interview)

  github.com
  GitHub
• GHSA-h78x-87rw-9vm8 - cognikit malware advisory (Contagious Interview carrier)

  github.com
  GitHub
• GHSA-wwmq-cqmr-r335 - aiassistcore malware advisory (Contagious Interview carrier)

  github.com
  GitHub
• GHSA-cj74-jpjj-63qf - aichannel malware advisory (Contagious Interview)

  github.com
  GitHub
• GHSA-8x7r-7883-gjgh - ailaunchkit malware advisory (Contagious Interview)

  github.com
  GitHub
• GHSA-fg2c-58m3-mg4m - reguestsc malware advisory (salatstealer)

  github.com
  GitHub