The claudeopuseni PyPI Startup-Hook Loader

What happened

claudeopuseni 0.1.1 shipped two new things that 0.1.0 did not carry: a file named claudeopuseni.pth and a loader that it runs. A .pth file is not documentation. When one sits in a Python site-packages folder, Python executes any line that starts with import at the start of every Python process, for every user on the machine, with no click and no visible window.

The startup line runs one function, claudeopuseni._boot.check(). The function has four behaviours that only make sense for an attack:

• It does nothing inside build farms and sandboxes. It checks for DAS_STAGED=1 and for a real user profile that contains a Documents or Downloads folder. Automated scanners on clean machines see a no-op.
• It throttles itself to one run every six hours, using a timestamp file in the temp folder, and drops a marker file named claudeopuseni-ran.marker.
• It calls a server at https://thisisafalsepositive.st/cdn/v2/claudeopuseni/manifest.json and downloads whatever the server returns. A working reply replaces the built-in payload on the victim machine.
• It decrypts the payload with ChaCha20 plus an HMAC-SHA256 check and runs the result with a hidden call to Python's exec. The key is a fixed string in the code.

The payload embedded in the wheel decrypts to a source file that labels itself an example and beacons the machine's hostname, username and OS version to https://example.invalid/beacon, an address that cannot resolve. That does not make the package safe. The remote manifest call is live, so a real second stage can reach every machine that has the package without any new release.

Two details point at planning rather than a joke. The domain thisisafalsepositive.st was registered on 17 June 2026, four months before the package, sits behind DDoS-Guard, and serves a login page at its root. And the package description, a jailbreak-prompt toolkit for Claude, is bait aimed at people and AI agents that work with Claude.

Affected versions

• claudeopuseni 0.1.1 carries the .pth file and the loader.
• 0.1.0 existed earlier the same day. PyPI has since quarantined the whole project, so the registry no longer serves metadata for any version.
• The wheel file itself is still reachable on the file host by direct URL, so tools that cache or mirror packages can still have it.
• Any Python 3 environment on any OS where the package was installed is affected. The loader has no version gate of its own.

Indicators of compromise

• Package: claudeopuseni on PyPI, versions 0.1.0 and 0.1.1
• Startup file: claudeopuseni.pth. It imports claudeopuseni._boot and calls its check() function. The full line is in the check command below.
• Instruction server: https://thisisafalsepositive.st/cdn/v2/claudeopuseni/manifest.json
• Beacon address in the embedded payload: https://example.invalid/beacon
• Files dropped: claudeopuseni-ran.marker and claudeopuseni-ck.ts in the temp folder (/tmp on macOS and Linux, %TEMP% on Windows)
• Decryption key string in the loader: claudeopuseni.2026.channel.v1
• Wheel uploaded 2026-10-25 22:48 UTC, source tarball 23:03 UTC

How to check

Look for the package and the startup file. The package is quarantined, so the registry no longer serves it, but an install from before the quarantine stays on disk. The startup file holds one line:

import claudeopuseni._boot; claudeopuseni._boot.check()

pip show claudeopuseni

Then search the Python environment for the startup file itself.

grep -rl claudeopuseni._boot "$(python3 -c 'import site; print(site.getsitepackages()[0])')"

On macOS and Linux, check the temp folder for the dropped files.

ls /tmp/claudeopuseni-ran.marker /tmp/claudeopuseni-ck.ts

On Windows, the same files sit in %TEMP%.

dir "%TEMP%\claudeopuseni*"

The marker file existing means the loader ran at least once on that machine.

What to do now

If claudeopuseni 0.1.1 ran on a machine with a real user profile, treat that machine as exposed. During the window the package was active, the remote server can send that machine code at any moment.

1. Uninstall the package: pip uninstall claudeopuseni.
2. Delete claudeopuseni.pth from site-packages if the uninstall leaves it behind.
3. Delete claudeopuseni-ran.marker and claudeopuseni-ck.ts from the temp folder.
4. Rotate credentials that live on the machine: cloud keys and CI tokens, SSH keys, browser-saved passwords, and any AI-provider API keys in environment variables or config files.
5. Block thisisafalsepositive.st at your DNS or proxy.
6. Check other machines that share the same Python environment or requirements file.

Why the payload looks fake

The decrypted code in the wheel says it is an example and points at an address that cannot resolve. Two readings fit. The first is a staged release: publish the loader while it is inert, let scanners argue about it, then publish the manifest and turn on the real payload with no new release to review. The second is a deliberate taunt aimed at automated scanners. Either way the loader itself is real and the manifest channel is live infrastructure, so the safe reading is the first one.

What Vigilance would show (rebuilt from public reports)

Vigilance compares the version you trust with the new one and names the file that gained a new power. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 73

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    setup.py
           It now runs a command on its own when it is installed, downloads from the internet and runs other programs. It did not before.

Sources

1. files.pythonhosted.org/packages/5a/1e/292fb1dbcff7e08dcf04fbef0fe921cd33cbb48daae5da3d7c9ad5825d2d/claudeopuseni-0.1.1-py3-none-any.whl
2. files.pythonhosted.org/packages/cd/dc/a2e59c79841f2a6f5b9c19e7679c5fcf793cf5bf3f476db286c3ff730a27/claudeopuseni-0.1.1.tar.gz