AgentArmorHQ
Sign in
Critical (AgentArmorHQ estimate)Supply chain

Malicious code in agent-vx (PyPI)

Product
agent-vx
Affected
agent-vx 0.1.0
Fixed in
No fix yet

Last verified against sources: October 26, 2026

Am I affected?

agent-vx: affected agent-vx 0.1.0. No fix has been reported yet.

  • Check your version: run pip show agent-vx. Versions = 0.1.0 of agent-vx are affected. [1]

What to do now

  1. Remove the package if it is installed: run pip uninstall agent-vx. [1]
  2. No fix is available yet. [1]

General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

Discuss this incident

What happened

  • The PyPI package agent-vx contains malicious code. [1]
  • The package installs a persistent job on the victim's machine. [1]
  • The malicious campaign is named 2026-10-agentaix. [1]

Impact

  • An attacker could exfiltrate files from the victim's machine. [1]
  • An attacker could execute remote code on the victim's machine. [1]
  • The package contains code to run remote commands on the victim's machine. [1]

What was done

  • No patched version is available. [1]
  • The advisory credits OpenSSF. [1]

Sources

  1. GHSA-qqmp-mxcj-44p3 — GitHub Advisory Database

Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.

Share advisory brief with your team

Copy a plain-text summary for Slack, GitHub issues, or team security channels.

Brief
Malicious code in agent-vx (PyPI)
Product: agent-vx | Affected: agent-vx 0.1.0 | Fixed in: No fix yet
Summary: The PyPI package agent-vx contains malicious code.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/10/ghsa-qqmp-mxcj-44p3-agent-vx
Was this page useful?

Corrections

Report an error or request a correction. We review requests within 5 business days and add a dated correction note.

10 to 2,000 characters. A link to a source helps. Stored as plain text.

Discussions for agent-vx

Ask questions or share configuration tips. Governed by our Community Rules & Terms.

No posts match this filter yet.

Be the first to ask a question or share a working tip.

← All incidentsRelated tools in directoryCheck package

Check before you install

Paste a package name or a GitHub link and get a clear answer in seconds: Block, Review or No known issues. No account needed.

Check a package

Questions? Contact us