# GitHub Advisory PyPI CWE-506 sweep - 14-package 2026-07-30/07-31 batch (`ml-*-shared` env-var exfil, `ai-perf-toolkit` + `mcp-search-server` cryptominer pair, `phabricator-client@99.x` dep-confusion, plus late-07-31 `2026-07-cognikit` DPRK Contagious Interview cluster and `reguestsc` salatstealer)

> GHSA published 14 PyPI CWE-506 advisories 2026-07-30–07-31: `ml-*-shared` env-var exfil kit (4 pkgs), `ai-perf-toolkit` + `mcp-search-server` cryptominer pair, `phabricator-client@99.x` dep-confusion, plus late-07-31 DPRK Contagious Interview `2026-07-cognikit` cluster (`aiprepkit`, `catalogai`, `cognikit`, `aiassistcore`, `aichannel`, `ailaunchkit`) and `reguestsc` salatstealer typosquat.

- Published: 2026-07-31
- Last updated: 2026-08-01
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: PyPI
- Scope: 14 packages, 24 compromised versions
- Tags: credential-theft, infostealer, dependency-confusion, ci-cd-compromise, obfuscation, crypto-wallet-drain, typosquat
- Threat actor: DPRK Contagious Interview (Cluster E only)
- Also known as: 2026-07-30/07-31 GHSA PyPI batch, ml-*-shared env-var exfil kit, ai-perf-toolkit / mcp-search-server cryptominer pair, phabricator-client dep-confusion probe, 2026-07-cognikit, Contagious Interview July 2026 wave, salatstealer reguestsc
- Detected by: GitHub Advisory Database, OpenSSF Package Analysis, PyPI Security
- Incident ID: pypi-2026-07-31-ghsa-malware-sweep

## Affected packages (14)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [ai-perf-toolkit](https://dependencywatch.io/package/pypi/ai-perf-toolkit) | PyPI | 2.4.2 |
| [aiassistcore](https://dependencywatch.io/package/pypi/aiassistcore) | PyPI | 0.1.2 |
| [aichannel](https://dependencywatch.io/package/pypi/aichannel) | PyPI | 0.1.2 |
| [ailaunchkit](https://dependencywatch.io/package/pypi/ailaunchkit) | PyPI | 0.1.2 |
| [aiprepkit](https://dependencywatch.io/package/pypi/aiprepkit) | PyPI | 0.1.2 |
| [catalogai](https://dependencywatch.io/package/pypi/catalogai) | PyPI | 0.1.2 |
| [cognikit](https://dependencywatch.io/package/pypi/cognikit) | PyPI | 0.1.2 |
| [mcp-search-server](https://dependencywatch.io/package/pypi/mcp-search-server) | PyPI | 1.0.0, 2.0.0, 2.0.1 |
| [ml-data-shared](https://dependencywatch.io/package/pypi/ml-data-shared) | PyPI | 12.0.1, 16.0.1 |
| [ml-fdbk-shared](https://dependencywatch.io/package/pypi/ml-fdbk-shared) | PyPI | 1.0.0, 2.3.1 |
| [ml-nps-shared](https://dependencywatch.io/package/pypi/ml-nps-shared) | PyPI | 6.0.3, 8.2.3 |
| [ml-shared](https://dependencywatch.io/package/pypi/ml-shared) | PyPI | 6.3.0, 8.8.0 |
| [phabricator-client](https://dependencywatch.io/package/pypi/phabricator-client) | PyPI | 99.0.0, 99.0.1, 99.0.2, 99.0.3, 99.0.4 |
| [reguestsc](https://dependencywatch.io/package/pypi/reguestsc) | PyPI | 2.34.2 |

## What happened

On 2026-07-30 and 2026-07-31, the GitHub Advisory Database published **14 new PyPI CWE-506 (Embedded Malicious Code) advisories** - 3 dated 2026-07-30 and 11 dated 2026-07-31. This module catalogues that batch. This entry was updated 2026-08-01 to add the late-07-31 DPRK Contagious Interview `2026-07-cognikit` cluster (6 packages) and the `reguestsc` salatstealer typosquat (1 package) that landed after the initial 07-31 ingest snapshot.

Unlike the recent all-versions boilerplate npm sweeps, every PyPI advisory in this batch carries **specific-behaviour prose** (install-time env-var exfil, import-time cryptomining, dep-confusion probe, phone-home for miner delivery, DPRK crypto-wallet-drainer / infostealer, downloaded-payload infostealer) - indicating GHSA / OpenSSF Package Analysis observed the packages in dynamic analysis rather than relying only on registry-side static-metadata flags. That specificity lets defenders scope the blast radius per-cluster rather than assume worst-case for all 14.

## Cluster A - `ml-*-shared` install-time env-var exfil kit (4 packages, 2026-07-31)

| Package | Versions | Notes |
|---|---|---|
| `ml-shared` | `6.3.0`, `8.8.0` | env-var exfil |
| `ml-fdbk-shared` | `1.0.0`, `2.3.1` | env-var exfil (feedback-loop namespace) |
| `ml-nps-shared` | `6.0.3`, `8.2.3` | env-var exfil (NPS = Net Promoter Score?) |
| `ml-data-shared` | `12.0.1`, `16.0.1` | env-var exfil |

Every advisory reuses the identical boilerplate: **"during installation, package exfiltrates basic info and all environmental variables … captures system data like IP addresses and usernames."** Same day, same wording, same behaviour, same "-shared" naming convention across 4 packages - unambiguously one operator running an install-time env-var exfil kit against ML-tooling namespaces. The version pairs (each package flagged at 2 non-adjacent versions rather than a single release) suggest the operator maintained the packages for a period to blend into normal release cadence before flagging.

The `ml-*-shared` naming is a classic dep-confusion probe pattern against internal ML-platform library namespaces at organisations that maintain a shared ML tooling package (e.g. `<company>-ml-shared` internal Python libraries). CI environments that inject cloud / LLM / ML-platform API keys via env vars into pip install are the primary exposure - a single `pip install ml-shared` in a CI job with `OPENAI_API_KEY` / `HUGGINGFACE_TOKEN` / `AWS_ACCESS_KEY_ID` in the environment exfiltrates all of them.

## Cluster B - `ai-perf-toolkit` import-time cryptominer (1 package, 2026-07-30)

| Package | Versions | Notes |
|---|---|---|
| `ai-perf-toolkit` | `<= 2.4.2` (representative `2.4.2` recorded) | import-time cryptominer for hardcoded wallet |

GHSA advisory: **"During import, the package starts cryptomining for a hardcoded wallet. The mining software has to already be installed."** Import-time (not install-time) trigger - activates whenever any Python code does `import ai_perf_toolkit`, so a single dev-machine test-import is enough to detonate on any host that also has the mining binary pre-installed. The "mining software has to already be installed" qualifier means the payload is a launcher, not a full miner - reduces malware footprint (no need to smuggle a large binary through pip) but requires a co-located miner install, which suggests **Cluster C `mcp-search-server`** as the paired dropper.

## Cluster C - `mcp-search-server` cryptominer phone-home dropper (1 package, 2026-07-30)

| Package | Versions | Notes |
|---|---|---|
| `mcp-search-server` | `1.0.0`, `2.0.0`, `2.0.1` | "share compute swarm" phone-home, prep for cryptominer delivery |

GHSA advisory: implements hidden "phone home" functionality under the guise of a "share compute swarm" feature, with **evidence suggesting preparation for deploying cryptocurrency miners**. Same-day publish as `ai-perf-toolkit` and same cryptomining target class - probable same operator: `mcp-search-server` phone-home confirms a live host, `ai-perf-toolkit` is the payload-delivery vector once the miner binary lands. The `mcp-*` naming targets the Model Context Protocol namespace (Anthropic AI-agent tooling) - an active landgrab area with a burst of typosquats through 2026 Q2/Q3.

## Cluster D - `phabricator-client@99.x` dep-confusion probe (1 package, 5 versions, 2026-07-30)

| Package | Versions | Notes |
|---|---|---|
| `phabricator-client` | `99.0.0`, `99.0.1`, `99.0.2`, `99.0.3`, `99.0.4` | host-info exfil, dep-confusion via artificially-high version numbers |

GHSA advisory: **"exfiltrates basic information about the host during installation and has no legitimate functionality."** Version numbers starting at `99.0.0` is the canonical dependency-confusion pattern - attacker publishes with an artificially high version number so that pip's resolver preferentially picks the public malicious package over the target organisation's private `phabricator-client` internal library.

Phabricator is a defunct-but-still-widely-installed code-review platform (Facebook / Meta origin, spun out to independent Phorge fork after Phabricator shutdown, still maintained internally at multiple engineering orgs including derivative deployments at other companies). This is a targeted probe against companies still maintaining internal Phabricator integration libraries - a smaller target surface than a broad-scatter typosquat, but the hit-rate is high on any org that still runs Phabricator infrastructure.

## Cluster E - DPRK Contagious Interview `2026-07-cognikit` cluster (6 packages, all `= 0.1.2`, late 2026-07-31)

| Package | Version | Role |
|---|---|---|
| `aiprepkit` | `0.1.2` | fake AI-tooling wrapper, pulls `cognikit`/`aiassistcore` |
| `catalogai` | `0.1.2` | fake AI-tooling wrapper, pulls C2 dependencies |
| `cognikit` | `0.1.2` | **carrier - C2 config + malicious payload** |
| `aiassistcore` | `0.1.2` | **carrier - RAT / remote-command-exec payload** |
| `aichannel` | `0.1.2` | fake AI-tooling wrapper |
| `ailaunchkit` | `0.1.2` | fake AI-tooling wrapper |

Every GHSA advisory in this cluster explicitly names it as **North Korea "Contagious Interview" activity**. The malware performs: crypto-wallet address replacement (clipboard hijack), browser data exfiltration, keylogging, clipboard modification, RAT command execution, and persistence via malicious browser extensions.

The cluster uses a **carrier/wrapper pairing pattern**: `aiprepkit`/`catalogai`/`aichannel`/`ailaunchkit` provide plausible fake AI-tooling functionality on the surface and pull `cognikit`/`aiassistcore` as transitive dependencies - the latter two carry the actual C2 config and payload. All 6 packages share the `= 0.1.2` version pin and were published within a tight window on late 07-31, indicating one coordinated drop.

This is the same DPRK operation catalogued in `multi-2026-04-07-contagious-interview-5-ecosystems`, `npm-2026-02-27-stegabin-contagious-interview`, `multi-2026-02-11-lazarus-graphalgo`, and `pypi-2026-07-01-chocopoc-frint-skytext` - new campaign wave, this one targeting the Python AI-tooling namespace (aiprep / cognit / aichannel / ailaunchkit are all plausibly-named fake tools the operator would present to a Contagious Interview target as "the assessment codebase").

## Cluster F - `reguestsc` salatstealer typosquat (1 package, `= 2.34.2`, 2026-07-31)

| Package | Version | Notes |
|---|---|---|
| `reguestsc` | `2.34.2` | `requests` typosquat, on-import remote-binary download → salatstealer infostealer |

GHSA advisory: **"Downloads and executes a remote executable"**, payload identified as **salatstealer** - a Go-based Windows infostealer that harvests browser credentials, Discord tokens, crypto-wallet artefacts, and Telegram sessions. Version `2.34.2` mirrors the current legitimate `requests` release, priming the typo to catch developers version-pinning to `requests==2.34.2`.

The salatstealer family has been active across npm and PyPI through 2026 as a commodity-payload delivered by opportunistic typosquats - this is the first `requests`-family typosquat GHSA has flagged for it in the current wave.

## Registry state

All 14 packages security-yanked from PyPI during the 2026-07-30 / 07-31 takedown. Original version tarballs are no longer resolvable on the public index, but private mirrors (devpi, Artifactory, Nexus, AWS CodeArtifact, Google Artifact Registry) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

## Related tracked activity

- Cluster C `mcp-*` namespace targeting is consistent with the 2026-07 MCP-namespace typosquat activity around `npm-2026-07-30-ghsa-malware-sweep` and the earlier `multi-2026-04-29-promptmink-validate-sdk` MCP-adjacent campaign.
- Cluster D `phabricator-client@99.x` fits the broader 2026 dep-confusion probe wave - same technique as `npm-2026-06-29-internal-scope-dep-confusion-cluster` and `pypi-2026-07-21-ghsa-mass-backfill`.
- Cluster E is attributed to **DPRK Contagious Interview** - same threat actor tracked in `multi-2026-02-11-lazarus-graphalgo`, `npm-2026-02-27-stegabin-contagious-interview`, `multi-2026-04-07-contagious-interview-5-ecosystems`, `pypi-2026-07-01-chocopoc-frint-skytext`, and `npm-2026-07-03-jfrog-lazarus-rollup-polyfill-ottercookie`.
- Cluster F `reguestsc` salatstealer echoes the salatstealer-payload pattern used across several 2026 typosquat drops - commodity payload / opportunistic delivery.

## Impact

- Any host that installed any of the 7 PyPI packages listed below should be treated as fully compromised - every GHSA record carries the CWE-506 "malicious code" classification with no patched version
- **Cluster A - `ml-*-shared` env-var exfil kit** (4 packages, all 2026-07-31): `ml-shared@6.3.0,8.8.0`, `ml-fdbk-shared@1.0.0,2.3.1`, `ml-nps-shared@6.0.3,8.2.3`, `ml-data-shared@12.0.1,16.0.1`. Every advisory reuses the same identical boilerplate: "during installation, package exfiltrates basic info and all environmental variables … captures system data like IP addresses and usernames." Same day, same wording, same behaviour, same "-shared" naming convention across 4 packages - unambiguously one operator running an install-time env-var exfil kit against ML-tooling namespaces. The version pairs (each package flagged at 2 non-adjacent versions) suggest the operator maintained the packages for a period to blend into normal release cadence before flagging
- **Cluster B - `ai-perf-toolkit` cryptominer** (1 package, versions `<= 2.4.2`, 2026-07-30): `ai-perf-toolkit`. GHSA advisory: "during import, the package starts cryptomining for a hardcoded wallet. The mining software has to already be installed." Import-time (not install-time) trigger - activates whenever any Python code does `import ai_perf_toolkit`, so a single dev-machine test-import is enough to detonate on any host that also has the mining binary pre-installed
- **Cluster C - `mcp-search-server` cryptominer phone-home** (1 package, versions `1.0.0`, `2.0.0`, `2.0.1`, 2026-07-30): `mcp-search-server`. GHSA advisory: implements hidden "phone home" functionality under the guise of a "share compute swarm" feature, with evidence suggesting preparation for deploying cryptocurrency miners. **Same-day publish as `ai-perf-toolkit`** and same cryptomining target class - probably the same operator: `ai-perf-toolkit` is the payload-delivery vector once `mcp-search-server` phone-home confirms a live host. The `mcp-*` naming targets the Model Context Protocol namespace (Anthropic AI-agent tooling), an active landgrab area
- **Cluster D - `phabricator-client@99.0.0–99.0.4` dep-confusion probe** (1 package, 5 versions, 2026-07-30): `phabricator-client`. **Version numbers starting at `99.0.0`** is the canonical dependency-confusion pattern - attacker publishes with an artificially high version number so that pip's resolver preferentially picks the public malicious package over the target organisation's private `phabricator-client` internal library. Phabricator is a defunct-but-still-widely-installed code-review platform (Facebook / Meta and derivative deployments at other engineering orgs) - this is a targeted probe against companies still maintaining internal Phabricator integration libraries
- **Cluster E - DPRK Contagious Interview `2026-07-cognikit` cluster** (6 packages, all `= 0.1.2`, late 2026-07-31): `aiprepkit`, `catalogai`, `cognikit`, `aiassistcore`, `aichannel`, `ailaunchkit`. Every advisory explicitly names this as **North Korea "Contagious Interview" activity**: crypto-wallet address replacement, browser data exfil, keylogging, clipboard modification, RAT, persistence via malicious browser extensions, remote command execution. Package pairing: `aiprepkit`/`catalogai`/`aichannel`/`ailaunchkit` provide fake AI-tooling functionality and pull `cognikit`/`aiassistcore` as dependencies - the latter carry the C2 config and malicious payload. This is the same DPRK operation catalogued in `multi-2026-04-07-contagious-interview-5-ecosystems`, `npm-2026-02-27-stegabin-contagious-interview`, and `pypi-2026-07-01-chocopoc-frint-skytext` - new campaign wave targeting Python AI-tooling namespace via fake job assessments
- **Cluster F - `reguestsc` salatstealer typosquat** (1 package, `= 2.34.2`, 2026-07-31): `reguestsc` is a `requests` typosquat (extra `e` and `c`) that on import downloads and executes a remote binary identified by researchers as **salatstealer** - a Go-based Windows infostealer that harvests browser credentials, discord tokens, crypto-wallet artefacts, and Telegram sessions. Version `2.34.2` matches the current legitimate `requests` release, priming the typo to catch developers pinning to a specific version
- None of the 14 packages retain original tarballs on PyPI - all yanked during the takedown. Private mirrors that cached tarballs BEFORE the takedown WILL keep serving the original versions

## What to do

1. Grep every lockfile (`requirements.txt`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, `conda-lock.yml`) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the affected process could reach and re-image the host
2. **Cluster A (`ml-*-shared` env-var exfil kit)**: any lockfile hit at any version: rotate every environment-injected credential (LLM API keys, cloud provider secrets, HuggingFace / W&B / MLflow tokens, database URLs, S3 access keys) that the process had access to at install time. The advisory boilerplate is specifically install-time env-var scraping - CI environments injecting secrets via env vars into pip install are the primary exposure
3. **Cluster B (`ai-perf-toolkit` cryptominer)**: any lockfile hit at any version `<= 2.4.2`: check the host for pre-installed mining binaries (xmrig, ethminer, minergate) and rotate any cloud-provider billing / VM console credentials from the affected host - an unattended cryptominer on a paid VM burns cash and often triggers cloud abuse-detection lockouts
4. **Cluster C (`mcp-search-server`)**: any lockfile hit at any of `1.0.0`, `2.0.0`, `2.0.1`: audit outbound network for the phone-home C2 channel and pull the hosts off the network before mining-binary payload delivery completes. If the host also has `ai-perf-toolkit`, treat as active cryptominer infection
5. **Cluster D (`phabricator-client@99.x`)**: configure your private PyPI mirror (Artifactory, Nexus, devpi, Google Artifact Registry, AWS CodeArtifact) with **explicit package-name allow-lists** for internal packages so pip never falls through to the public registry for `phabricator-client` and related internal-tool names. Audit any recent CI runs that resolved `phabricator-client` against the public registry
6. **Cluster E (DPRK Contagious Interview `2026-07-cognikit`)**: any hit on any of the 6 packages: treat the host as an active DPRK Contagious Interview infection - rotate every crypto-wallet seed phrase, exchange API key, browser-stored credential, Telegram session, and Discord token accessible from the affected host. Move funds via a clean device BEFORE any rotation. Remove any recently-installed browser extensions (persistence vector), clear extension storage, and reset browser profiles from a known-clean device. Look for outbound traffic to attacker C2 endpoints listed in Socket / Phylum / Wiz Contagious Interview writeups. This is a targeted nation-state operation - a hit at a developer workstation is grounds for a full DFIR sweep, not just a package removal
7. **Cluster F (`reguestsc` salatstealer)**: any lockfile or `pip freeze` hit on `reguestsc` at `2.34.2`: treat as full Windows workstation compromise. Rotate every browser-stored credential, Discord token, Telegram session, and inspect every crypto-wallet balance. Confirm the intended package name is `requests` (no `e`, no `c`) and re-install from a verified requirement pin
8. For all PyPI installs in CI, prefer `pip install --require-hashes` with a fully-hashed `requirements.txt` or Poetry / uv / pdm lockfiles that pin resolved hashes - hash-pinning defeats replacement of a resolved-to package with a same-name malicious package after initial resolution
9. Verify none of the 14 listed packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent PyPI malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub
- [GHSA-r6hm-wcqx-r255 - ml-shared malware advisory](https://github.com/advisories/GHSA-r6hm-wcqx-r255) - GitHub
- [GHSA-hf8q-5jww-9c56 - ml-fdbk-shared malware advisory](https://github.com/advisories/GHSA-hf8q-5jww-9c56) - GitHub
- [GHSA-fm92-h663-5c62 - ml-nps-shared malware advisory](https://github.com/advisories/GHSA-fm92-h663-5c62) - GitHub
- [GHSA-cqgc-q24x-3g9m - ml-data-shared malware advisory](https://github.com/advisories/GHSA-cqgc-q24x-3g9m) - GitHub
- [GHSA-9p9m-j35v-j8cp - ai-perf-toolkit malware advisory](https://github.com/advisories/GHSA-9p9m-j35v-j8cp) - GitHub
- [GHSA-3rhm-6v7p-whrg - mcp-search-server malware advisory](https://github.com/advisories/GHSA-3rhm-6v7p-whrg) - GitHub
- [GHSA-pph4-3958-ffpq - phabricator-client malware advisory](https://github.com/advisories/GHSA-pph4-3958-ffpq) - GitHub
- [GHSA-wg77-wqj2-3733 - aiprepkit malware advisory (Contagious Interview)](https://github.com/advisories/GHSA-wg77-wqj2-3733) - GitHub
- [GHSA-6cqw-65hg-qqm3 - catalogai malware advisory (Contagious Interview)](https://github.com/advisories/GHSA-6cqw-65hg-qqm3) - GitHub
- [GHSA-h78x-87rw-9vm8 - cognikit malware advisory (Contagious Interview carrier)](https://github.com/advisories/GHSA-h78x-87rw-9vm8) - GitHub
- [GHSA-wwmq-cqmr-r335 - aiassistcore malware advisory (Contagious Interview carrier)](https://github.com/advisories/GHSA-wwmq-cqmr-r335) - GitHub
- [GHSA-cj74-jpjj-63qf - aichannel malware advisory (Contagious Interview)](https://github.com/advisories/GHSA-cj74-jpjj-63qf) - GitHub
- [GHSA-8x7r-7883-gjgh - ailaunchkit malware advisory (Contagious Interview)](https://github.com/advisories/GHSA-8x7r-7883-gjgh) - GitHub
- [GHSA-fg2c-58m3-mg4m - reguestsc malware advisory (salatstealer)](https://github.com/advisories/GHSA-fg2c-58m3-mg4m) - GitHub

---

Canonical page: https://dependencywatch.io/incident/pypi-2026-07-31-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/pypi-2026-07-31-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).