GitHub Advisory PyPI CWE-506 sweep - 7-package 2026-08-01 batch (`asdk-plugin-*` 3-package dep-confusion trio at `0.0.1`/`9999.0.0`, `walmart-genai-trace` dep-confusion probe, `telerape` PTH-file reverse-shell, `nvtorch-oot-nightly`/`trtllm-subdir-test` NVIDIA-adjacent dep-confusion probe pair at `99999.0.0`/`99999.0.1`)

What happened

On 2026-08-01, the GitHub Advisory Database published 7 new PyPI CWE-506 (Embedded Malicious Code) advisories in a same-day burst. This module catalogues that batch. Every advisory in this batch carries specific-behaviour prose (install-time env-var exfil, dep-confusion probe versioning, .pth-file reverse-shell persistence) - indicating GHSA / OpenSSF Package Analysis observed the packages in dynamic analysis rather than relying only on registry-side static-metadata flags.

Cluster A - asdk-plugin-* dep-confusion trio (3 packages, 2026-08-01)

| Package | Versions | Notes | |---|---|---| | asdk-plugin-alphagen | 0.0.1, 9999.0.0 | dep-confusion double-pin | | asdk-plugin-legacy | 0.0.1, 9999.0.0 | dep-confusion double-pin | | asdk-plugin-ai-platform | 0.0.1, 9999.0.0 | dep-confusion double-pin |

All three advisories share identical boilerplate: "installing the package or importing the module exfiltrates basic information about the host" (IP, username) and "overrides the install command in setup.py to execute malicious code during installation." Same-day publish, identical naming template (asdk-plugin-<suffix>), identical version pair (0.0.1 + 9999.0.0) - one operator running a coordinated dep-confusion probe against an internal asdk-plugin-* architecture.

The 0.0.1 + 9999.0.0 version pair is the canonical dependency-confusion double-pin technique - 0.0.1 catches unversioned pip resolvers that pick the lowest available number as a fallback, and 9999.0.0 guarantees the resolver picks the public malicious version over any internal <company>-asdk-plugin-* library at any real semver like 1.2.3 or 4.5.6. asdk reads as a generic internal "app SDK" naming template - the target org uses asdk-plugin-* as a plugin architecture for their internal SDK (common at large fintech and cloud-tools orgs).

Cluster B - walmart-genai-trace targeted internal-namespace probe (1 package, 2026-08-01)

| Package | Versions | Notes | |---|---|---| | walmart-genai-trace | <= 99.0.0 (representative pins recorded) | Walmart internal GenAI tracing dep-confusion probe |

GHSA advisory: "installing the package or importing the module exfiltrates basic information about the host … overrides the install command in setup.py to execute malicious code during installation." The explicit walmart-* namespace prefix marks this as a targeted probe against Walmart's internal Python GenAI tracing tooling. Walmart operates one of the largest enterprise ML/GenAI platforms globally and maintains extensive internal Python packages under a walmart-* naming convention.

A public walmart-genai-trace matching an internal package name at Walmart (or a Walmart subsidiary like Sam's Club, or an integration partner) would resolve preferentially with the <= 99.0.0 catch-all range on any Walmart-internal CI pipeline that misconfigures its pip index precedence. This is the highest-signal targeted-attribution advisory in the 08-01 batch - the operator went out of their way to name-target Walmart specifically.

Cluster C - telerape PTH-file reverse-shell persistence (1 package, 2026-08-01)

| Package | Versions | Notes | |---|---|---| | telerape | 0.0.0.dev0, 1.0.0, 1.0.1 | PTH-file reverse-shell persistence |

GHSA advisory: "places a reverse shell in the PTH file." Python .pth files live in site-packages/ and are automatically processed by every Python interpreter start via the site module's path-hook mechanism. Any line in a .pth file that begins with import is executed by Python at startup - a well-documented Python feature intended for path configuration but weaponisable as persistent code execution.

By dropping a .pth file with a reverse-shell import/exec line, telerape achieves persistent code execution independent of the malicious package: pip uninstall telerape removes the package but leaves the .pth file behind, which continues to spawn the reverse shell on every subsequent Python startup on the host. This is a persistence mechanism, not a one-shot payload - full host DFIR (site-packages .pth audit, then re-image) is the reliable remediation.

The PTH-file persistence technique has been documented publicly by Snyk (2023), JFrog (2024), and re-surfaced in ReversingLabs research through 2025 - this is the first GHSA-flagged 2026 PyPI package using the technique.

Cluster D - NVIDIA-adjacent nvtorch-oot-nightly / trtllm-subdir-test dep-confusion probe pair (2 packages, 2026-08-01)

| Package | Versions | Notes | |---|---|---| | nvtorch-oot-nightly | 99999.0.0, 99999.0.1 | NVIDIA-internal PyTorch out-of-tree nightly namespace probe | | trtllm-subdir-test | 99999.0.0, 99999.0.1 | NVIDIA TensorRT-LLM subdir-test internal namespace probe |

Both advisories share identical boilerplate: "installing the package or importing the module exfiltrates basic information about the host" (IP, username) and "overrides the install command in setup.py to execute malicious code during installation." Same-day publish, both at the extreme-inflated 99999.0.0 / 99999.0.1 version pair - canonical dep-confusion pin technique that guarantees the public malicious version outranks any internal <major>.<minor>.<patch> semver on any resolver that resolves against the public PyPI index.

• nvtorch-oot-nightly - "nvtorch" is NVIDIA-internal shorthand for NVIDIA-forked PyTorch; "OOT" = out-of-tree, referring to NVIDIA-maintained kernel / operator forks that aren't merged upstream; "nightly" indicates a nightly-build wheel. Combined name targets NVIDIA GPU-compute pipelines that pull NVIDIA-forked PyTorch nightly wheels from an internal index.
• trtllm-subdir-test - "trtllm" is the internal shorthand for TensorRT-LLM, NVIDIA's open-source LLM inference optimisation library; "subdir-test" matches the subdirectory-test naming convention used inside TensorRT-LLM's build / packaging scripts. Combined name targets CI pipelines at NVIDIA-adjacent GenAI research orgs that build against TensorRT-LLM subdirectory-packaged submodules.

Both names are highly implausible as public open-source library names - they only make sense as internal-namespace pins. The explicit NVIDIA-internal namespace targeting is the highest-signal attribution in the 08-01 batch alongside Cluster B's Walmart-namespace targeting.

Registry state

All 7 packages security-yanked from PyPI during the 2026-08-01 takedown. Original version tarballs are no longer resolvable on the public index, but private mirrors (devpi, Artifactory, Nexus, AWS CodeArtifact, Google Artifact Registry) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

Related tracked activity

• Cluster A asdk-plugin-* and Cluster B walmart-genai-trace both extend the dep-confusion probe wave catalogued in pypi-2026-07-31-ghsa-malware-sweep Cluster D (phabricator-client@99.x) and pypi-2026-07-21-ghsa-mass-backfill.
• Cluster C telerape is the first PTH-file-reverse-shell payload catalogued in DependencyWatch for 2026 - technique is public / commodity but the operator implementation is worth tracking.
• Cluster D nvtorch-oot-nightly / trtllm-subdir-test extends the same NVIDIA-internal-namespace probe pattern seen in the 2025 nvidia-* and tritonserver-* dep-confusion sweeps documented by Snyk and JFrog.
• No threatActor field is set - GHSA advisories in this batch use CWE-506 boilerplate without named actor attribution, though Cluster B's explicit Walmart-namespace targeting is likely-attributable in later vendor writeups.

Affected packages (7)

Impact

• Any host that installed any of the 5 PyPI packages listed below should be treated as fully compromised - every GHSA record uses CWE-506 with no patched version. Cluster C telerape in particular is a PTH-file reverse-shell persistence mechanism that survives package uninstall
• *Cluster A - `asdk-plugin- dep-confusion trio** (3 packages, all 0.0.1 and 9999.0.0, 2026-08-01): asdk-plugin-alphagen, asdk-plugin-legacy, asdk-plugin-ai-platform. Every advisory: "exfiltrates basic information about the host" (IP, username) during install and "overrides the install command in setup.py to execute malicious code during installation." **The 0.0.1 + 9999.0.0 version pair is the canonical dependency-confusion double-pin** - 0.0.1 catches unversioned pip resolvers that pick the lowest number, and 9999.0.0 guarantees the resolver picks the public malicious version over any internal <company>-asdk-plugin- library at any semver. The asdk-plugin- naming implies an internal SDK plugin architecture (asdk = generic "app SDK" template) - targeted at whichever org maintains internal asdk-plugin-*` packages
• Cluster B - walmart-genai-trace Walmart-internal dep-confusion probe (1 package, versions <= 99.0.0, 2026-08-01): walmart-genai-trace. GHSA advisory: "installing the package or importing the module exfiltrates basic information about the host … overrides the install command in setup.py to execute malicious code during installation." *Explicit `walmart- namespace prefix** - targeted probe against Walmart's internal Python GenAI tracing tooling. Walmart operates one of the largest enterprise ML/GenAI platforms globally and maintains extensive internal Python packages under a walmart-* naming convention - a public walmart-genai-trace matching an internal package name at Walmart or its subsidiaries would resolve preferentially with the <= 99.0.0` catch-all range
• Cluster C - telerape PTH-file reverse-shell (1 package, versions 0.0.0.dev0, 1.0.0, 1.0.1, 2026-08-01): telerape. GHSA advisory: "places a reverse shell in the PTH file." Python .pth files are executed automatically by every Python interpreter start (via the site module's path-hook mechanism), giving the attacker persistent code execution independent of the malicious package - pip uninstall telerape removes the package but leaves the .pth file behind. This is a persistence mechanism, not a one-shot payload
• Cluster D - NVIDIA-adjacent nvtorch-oot-nightly / trtllm-subdir-test dep-confusion probe pair (2 packages, both at 99999.0.0 and 99999.0.1, 2026-08-01): nvtorch-oot-nightly, trtllm-subdir-test. Both advisories: "installing the package or importing the module exfiltrates basic information about the host … overrides the install command in setup.py to execute malicious code during installation." The 99999.0.0 / 99999.0.1 version pair is the extreme-inflated dep-confusion pin technique - guarantees the resolver picks the public malicious version over any internal nvtorch-* or trtllm-* package at any real semver. nvtorch-oot-nightly = NVIDIA PyTorch out-of-tree nightly (internal name for NVIDIA-forked PyTorch nightly builds); trtllm-subdir-test = NVIDIA TensorRT-LLM subdirectory test (internal name shape used inside NVIDIA's TensorRT-LLM monorepo build scripts). Explicit NVIDIA-internal namespace targeting - probable probe against NVIDIA GPU-compute engineering pipelines or NVIDIA-adjacent GenAI research orgs that mirror NVIDIA's internal Python package naming
• None of the 7 packages retain original tarballs on PyPI - all yanked during the 2026-08-01 takedown. Private mirrors that cached tarballs BEFORE the takedown WILL keep serving the original versions

What to do

1. 1Grep every lockfile (requirements.txt, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda-lock.yml) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the affected process could reach and re-image the host
2. 2*Cluster A (`asdk-plugin-)**: any lockfile hit at either 0.0.1 or 9999.0.0: rotate every install-time credential the CI runner injected via env vars (cloud provider secrets, LLM API keys, HuggingFace / W&B / MLflow tokens, database URLs). Configure your private PyPI mirror (Artifactory, Nexus, devpi, Google Artifact Registry, AWS CodeArtifact) with **explicit package-name allow-lists** for asdk-plugin-*` names so pip never falls through to the public registry for internal SDK-plugin packages
3. 3Cluster B (walmart-genai-trace): Walmart-internal developers and Walmart-adjacent contractor CI pipelines: audit every pip resolution against the public index for walmart-* names in the last 72h. Rotate every credential the CI job that resolved walmart-genai-trace could reach. Confirm the intended internal package (walmart-* naming should always resolve to Walmart-internal PyPI mirror, never the public index) and pin via --index-url in every CI pipeline that touches Walmart-internal repos
4. 4Cluster C (telerape): any lockfile or pip freeze hit on telerape at 0.0.0.dev0, 1.0.0, or 1.0.1: DO NOT ASSUME pip uninstall REMEDIATES. The reverse-shell lives in a .pth file that persists after package removal. Grep site-packages/, ~/.local/lib/python*/site-packages/, and every venv on the host for .pth files matching the telerape install path AND for any .pth file with import / exec / eval / socket-connection code. Full host re-image is the reliable remediation
5. 5Cluster D (nvtorch-oot-nightly / trtllm-subdir-test): NVIDIA GPU-compute engineering pipelines and NVIDIA-adjacent GenAI research orgs: audit every pip resolution against the public index for nvtorch-* or trtllm-* names in the last 72h. Configure your private PyPI mirror (Artifactory, Nexus, devpi, AWS CodeArtifact, Google Artifact Registry) with explicit package-name allow-lists for NVIDIA-internal nvtorch-* and trtllm-* naming so pip never falls through to the public index for those names. Pin your internal PyPI mirror via --index-url in every CI pipeline that touches NVIDIA-forked PyTorch or TensorRT-LLM build artefacts
6. 6For all PyPI installs in CI, prefer pip install --require-hashes with a fully-hashed requirements.txt or Poetry / uv / pdm lockfiles that pin resolved hashes - hash-pinning defeats swap-of-resolved-package with a same-name malicious package after initial resolution
7. 7Verify none of the 7 listed packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

• GitHub Advisory Database - recent PyPI malware advisories

  github.com
  GitHub
• GHSA-p292-pv53-3p47 - asdk-plugin-alphagen malware advisory

  github.com
  GitHub
• GHSA-6h9x-rrwg-j3wg - asdk-plugin-legacy malware advisory

  github.com
  GitHub
• GHSA-pwmm-jg95-fq28 - asdk-plugin-ai-platform malware advisory

  github.com
  GitHub
• GHSA-wj6q-qw9c-whxq - walmart-genai-trace malware advisory (Walmart-internal dep-confusion probe)

  github.com
  GitHub
• GHSA-2x4m-3m75-45jg - telerape malware advisory (PTH-file reverse-shell)

  github.com
  GitHub
• GHSA-5g9f-m99h-h89p - nvtorch-oot-nightly malware advisory (NVIDIA PyTorch out-of-tree nightly dep-confusion probe)

  github.com
  GitHub
• GHSA-2fm3-ggxx-45vm - trtllm-subdir-test malware advisory (NVIDIA TensorRT-LLM subdir-test dep-confusion probe)

  github.com
  GitHub