Four PyPI Typosquats Ran Before Anyone Typed 'import'
GitHub reviewed four PyPI malware advisories on 11 September: langgrap, openaii, transfomers and ollamaa. A .pth file runs at interpreter start.
GitHub's Advisory Database reviewed four PyPI malware advisories together on 11 September 2026, each package name one character off a core AI library.
The names were langgrap, openaii, transfomers and ollamaa — one typo each from langgraph, openai, transformers and ollama. All four were reviewed the same day and grouped under one campaign label, 2026-09-openaii.
The four packages
| Fake name | Real target | Claimed version | Advisory |
|---|---|---|---|
| langgrap | langgraph | 0.2.45 | GHSA-crjm-2g45-pq97 |
| openaii | openai | ≤ 1.55.3 | GHSA-q5h5-h6mj-vhgv |
| transfomers | transformers | 4.44.2 | GHSA-2p95-qvc5-6rjq |
| ollamaa | ollama | 0.4.2 | GHSA-9gv4-vfjg-jjrm |
The payload runs without an import
Each advisory describes the same mechanism: a malicious .pth file. A .pth file is not an import — it runs the moment the Python interpreter starts, for any script in that environment, whether or not anything ever does import openaii. Having the package installed is enough.
From there the advisories describe one chain across all four: download a further stage from a remote host, exfiltrate SSH keys and cloud credentials, plant cryptocurrency mining software, install a persistence mechanism that survives reboot, and clear logs.
One detail is worth reading twice. The openaii advisory describes the payload as including, verbatim, "a simple attempt to discourage analysis via AI agents" — the same phrase appears in the langgrap, transfomers and ollamaa write-ups. The advisories do not say what that evasion looks like or which tools it targets, but the authors expected an AI coding assistant, not only a human, to read the code before it ran.
The version numbers were the tell
The fakes claimed plausible older releases rather than current ones. transfomers claimed 4.44.2 while the real transformers on PyPI was at 5.17.0 when the advisories landed; openaii claimed ≤ 1.55.3 against a real openai client at 3.13.0. Version numbers a target might not think to question.
A second batch, the same day
The same review cycle covered aitextkit-py and aitextutils-py (GHSA-657v-53xv-3xw9, GHSA-hm5j-9gw8-8568), a separate campaign labelled 2026-09-aitextkit-py and credited to researcher kam193 via the OpenSSF Malicious Packages Project. Same downloader pattern, different persistence mechanism — a systemd service named anymeetly-cameradriver.
Two campaigns on one day is two data points, not a wave — the source is explicit that it will not call a trend from a sample of two.
Typosquatting, not slopsquatting
GitHub's advisories describe all six packages as typosquatting, and the reporting author argues that is the accurate word: nothing in any of the six advisories says an AI assistant invented these names. Slopsquatting is the narrower case where a name exists only because a model hallucinated it, and these advisories do not establish that.
What the two share is the blind spot: none of the six packages had a CVE or advisory before 11 September, so a scanner checking only known vulnerabilities would have called all of them clean right up until GitHub published. The signal available earlier is adoption age — a package that is very new with almost no uptake. The reporting author says their own check on that basis found zero AI-hallucinated package names across 1,778 dependencies added in real pull requests.
What the advisories do not tell you
No install counts. PyPI's JSON API does not expose download figures, and once a package is pulled there is no public number to check retroactively — so whether one person or ten thousand installed any of the six before takedown is unknown. The advisories also do not say which AI coding tools the "discourage analysis" code targeted, or whether the two 11 September campaigns share an operator.
All four 2026-09-openaii names now return 404 from the PyPI JSON API, checked first-hand by the reporting author — removed three days after publication, which says nothing about how long they were live beforehand.
What to check
Grep your lockfiles and requirements.txt for the six names above. Then widen the rule: for any dependency added in the last month, check package age and adoption rather than CVE status, because a same-day typosquat has neither a CVE nor a history to fail on. And treat a .pth file in site-packages as executable code, not configuration — that is the part of this campaign that defeats "we never imported it."
More from DangMua