Poisoned Pipeline / Incidents / AS21
Deep-Live-Cam malicious git dependency
PyPIGit / GitHubmacOS softwareWindows software
On 8 September 2026 a commit on Deep-Live-Cam (96k GitHub stars) rewrote
requirements.txt to pull several packages from source URLs and added
linerequests @ git+https://github.com/pypls/requests.git — a lookalike of
the real Requests project. setup.py hid a loader past 434 spaces; it
fetched a clipboard-hijacking crypto stealer via a Telegraph page and
installed login persistence on Windows and macOS. The maintainer reported
unusual account access despite 2FA. SafeDep traced the chain; the
malicious revision sat on main for about 9 hours 39 minutes.
Mapped techniques
- T0113 Compromised user account
- T0197 Use code from untrusted source
- T0129 Typosquatting
- T0109 Publish malicious artifact
- T0151 Installation scripts
- T0159 Malicious artifact execution
- T0139 Resource hijacking
- T0138 Backdoor in code
supply-chain Deep-Live-Cam GitHub repository
Maintainer reported unusual account access despite 2FA; unsigned
commit on main under hacksider.
requirements.txt was pointed at git+https://github.com/pypls/requests.git
instead of PyPI.
pypls/requests declared package name requests and kept metadata of
the legitimate project.
The pypls/requests repo existed three days before the requirements.txt
change.
post-supply-chain Installers / end users
pip's setuptools backend executes setup.py during wheel build; the
loader ran before Deep-Live-Cam itself launched.
Hidden exec(compile(...)) in setup.py decoded and ran the loader.
Final payload replaced BTC/ETH/TRX/SOL addresses in the clipboard.
Windows Run key SysHelper and macOS LaunchAgent com.user.syshelper.plist
re-executed the stealer at login.
Framework gaps noted
- git+ URL substitution in requirements.txt is a specific "replace the registry with an attacker clone" path under T0197.