Malicious PyPI package dictanovaasr

published 2026-10-21

The PyPI package dictanovaasr 0.1.0 is listed as malicious code in the OSV malware database. One analysis found no evidence of exfiltration, credential harvesting or install-time code execution from external sources, so what it actually does is unconfirmed.

Source: OSV

Get the fix

Fixlane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the Fixlane MCP server and call get_fix_prompt with incident id 1223 and your operating system.