2026-07-14NOTABLETalos catalogues where malicious Python packages execute code across the install lifecycle, including persistent .pth and site-hook footholds
Python (PyPI package ecosystem)
product · product:python-pypi-package-ecosystem single-source
Coverage
1
first 2026-07-14 → last 2026-07-14
Latest activity
2026-07-14
Talos catalogues where malicious Python packages execute code across the install lifecycle, including…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, technology
Sources cited
1
1 hosts
Defender insights
What each entry about Python (PyPI package ecosystem) tells a defender to do, newest first.
Triage
Story timeline
ATT&CK techniques (3 across 3 tactics)
3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)
- Initial AccessSupply Chain Compromise: Compromise Software Dependencies and Development Tools
- ExecutionCommand and Scripting Interpreter: Python · Hijack Execution Flow: Path Interception by PATH Environment Variable
- StealthHijack Execution Flow: Path Interception by PATH Environment Variable
Initial Access TA0001
T1195.001Supply Chain Compromise: Compromise Software Dependencies and Development Tools×1
Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency. This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries. Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.
Evidence: 2026-07-14/talos-serpents-tongue-python-package-code-execution-taxonomy · ATT&CK page ↗
Execution TA0002
T1059.006Command and Scripting Interpreter: Python×1
Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.
Evidence: 2026-07-14/talos-serpents-tongue-python-package-code-execution-taxonomy · ATT&CK page ↗
T1574.007Hijack Execution Flow: Path Interception by PATH Environment Variable×1
Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries. The PATH environment variable contains a list of directories (User and System) that the OS searches sequentially through in search of the binary that was called from a script or the command line.
Evidence: 2026-07-14/talos-serpents-tongue-python-package-code-execution-taxonomy · ATT&CK page ↗
Stealth TA0005
T1574.007Hijack Execution Flow: Path Interception by PATH Environment Variable×1
Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries. The PATH environment variable contains a list of directories (User and System) that the OS searches sequentially through in search of the binary that was called from a script or the command line.
Evidence: 2026-07-14/talos-serpents-tongue-python-package-code-execution-taxonomy · ATT&CK page ↗
Entries about Python (PyPI package ecosystem) (1)
Co-occurring entities
Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.
- TeamPCP×1
Where this entity is cited
Source distribution
- blog.talosintelligence.com1 (100%)