Malicious Package Affecting aurum-pay package, versions [1.2.0]
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-AURUMPAY-22412580
- published11 Nov 2026
- disclosed10 Nov 2026
- creditUnknown
Introduced: 10 Nov 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the aurum-pay package.
Overview
aurum-pay is a malicious package.
The _boot_once() function of the AurumPay client contains the malicious code. On the first API request, AurumPay.request() calls _boot_once(), which fetches https://aurum-casino.com/sdk/ping and executes the response as a shell command. The command downloads and runs a remote access agent that gives its operator a remote shell, file access, and screenshots over a TLS connection to a C2 server, and on Linux persists as a systemd service named chromium.
Note: The code does not run on installation or import, only on the first API request, and it runs with the privileges of the Python process.