Malicious code in netweavex (PyPI)
The advisory, in context
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (3818fe7f3387637c23d6bc51d62f8fd64dc981c82167750cd3059eec73d2849c)
netweavex is a typosquat of the popular NetworkX library, reusing its public API, module layout, and README examples (including the import netweavex as nx idiom) under a lookalike name. On import netweavex, the top-level init.py loads netweavex.netweavex, whose module scope invokes exec() on a payload produced by reversing a string literal, base64-decoding it, and zlib-decompressing it (the decoded header is a valid zlib stream, x\xda...). This causes attacker-controlled, opaque bytecode to run on the installer's host at import time. A graph library has no legitimate reason to layer reverse+base64+zlib obfuscation around an exec() sink; the combination of lookalike name, API cloning, and import-time execution of hidden code is the canonical PyPI typosquat dropper shape.
Source: kam193 (96ae0ec579e95e33c63930792ee782e6229f77547efac35c3894a7e05c8af2ca)
Clone of a legitimated package. During import package executes obfuscated code that downloads code from a GitHub repository. During analysis, the code was just a placeholder.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-netweavex
Reasons (based on the campaign):
-
clones-real-package
-
obfuscation
-
Downloads and executes a remote malicious script.
-
typosquatting
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
3 explicitly affected versions
1.1.0, 1.1.1, 1.1.2
View affected-version evidence
{
"ranges": [],
"versions": [
"1.1.0",
"1.1.1",
"1.1.2"
]
}