Attack code used to wait for you
A typical malicious package does its work when you run it. You install a library, your code imports it, the bad file executes, and a scanner that watches imports has a chance to see it. The attack we caught this week does not wait. It runs the moment Python starts, for every user on the machine, with no import and no window.
The trick is a file type that has been there all along. A .pth file sits in Python's package folder and extends the module search path. Any line in it that starts with import is not a path. It is code, and Python runs it at startup. Attackers noticed years ago. The newest wave builds whole loaders on it.
What we caught on 25 October
The package claudeopuseni is sold on PyPI as a prompt-engineering toolkit for testing jailbreak prompts against Claude models. Version 0.1.1 shipped a .pth file next to the library code. The full analysis is in our attack library page. The short version:
- The hook fires at startup. Every Python process on the machine runs it, from cron jobs to editor language servers. Nothing opens and nothing logs.
- It hides from the machines that scan. The code does nothing on a build farm or in a sandbox. It checks for a real user profile with a Documents or Downloads folder and runs only there. It also runs at most once every six hours.
- It fetches instructions. It calls a server and downloads whatever the server returns. The payload inside the wheel is inert. The channel to replace it is live.
- It decrypts and runs. The payload is ChaCha20-encrypted with an HMAC check. The code decrypts it and hands it to Python's
exec.
Inert is not safe. The payload embedded in this wheel points at an address that cannot resolve. The remote channel does not. An attacker who controls that server ships real code to every installed machine without publishing a new version, which means no diff sees the change.
Why the old checks miss this class
Most teams review what a package does when its code runs. A startup hook runs before any review point and outside any run of your own code. A version diff that reads only library files sees the hook as one small file. The capability question is the only one that matters here: can this file do something the old version cannot do? In this case one file went from nothing to running code at every Python start, fetching instructions from a server, and executing them.
What to do about it
Do this now
- Pin the packages you install, and review the pins
- Search site-packages for
.pthfiles you cannot explain - Block the domains in our attack pages at your DNS
Do not rely on this
- Reputation scores. The package was hours old with zero history
- Sandbox scans. This loader does nothing on a clean machine
- Import-time monitoring. The hook runs before your imports
Vigilance answers the question the right way round. It compares the new version with the old one and shows the one file that gained a real capability. It flagged this release as a package that gained an install-time hook 33 minutes after publication. PyPI's own team quarantined it later that evening. Both were right.
About Vigilance
Modul4r Solutions, in Edmonton, Alberta, Canada, makes Vigilance. Vigilance protects the computers where your team builds software with AI tools. It catches a package update that gains a harmful power, before any list knows about it, and swaps it for the last safe version.