Suspicious 86% python Download

echogen 1.0.0

Canary token exfiltrates environment metadata

“Synthetic 12-lead ECG signal generator for testing, teaching, and ML workflows”

Import-time OOB callbackPython init file requests an OOB endpoint
SHA-25673abf98f2a393f53127f79837c8ff7efa4371d57083ff7cbf70bc9fb47bc8205
URLhttps://files.pythonhosted.org/packages/8d/01/37ae8c75390e21ee1a0062179c7dea08673e942c3a33b44f09537a6de857/echogen-1.0.0-py3-none-any.whl
MaleculeK(Li₂)O₄(S₂AsErEu)H₅(Cm₃Db₃F₂Os₃Po₂)Md₃(In₃Pa₃)

Also flagged by osm (The package fires a canarytokens.com beacon on every import via `_canary()`, collecting Docker/K8s/CI environment boolean flags, parent process name, install path prefix, and a random UUID — then ex…), osv (MAL-2026-17462: Malicious code in echogen (PyPI)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.