Malicious code in fastgptmini (PyPI)

---

__

Source: kam193 (3cca907106c3dceb5276e9bdbf8799367b44df9e12fe12098dd3ed215bb4f3b0)

During installation, the code downloads an obfuscated script, which attempts to tamper with Defender exclusions paths and then downloads a malicious executable

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-fastgptmini

Reasons (based on the campaign):

• Downloads and executes a remote executable.

• malware

• The package overrides the install command in setup.py to execute malicious code during installation.

• obfuscation