MAL-2026-11114 Malicious code in @wagni_bot/polygon (npm)

The npm package @wagnibot/polygon is a supply-chain credential stealer disguised as a Polygon SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

Malicious code in @wagni_bot/hyperliquid (npm)

The npm package @wagnibot/hyperliquid is a supply-chain credential stealer disguised as a Hyperliquid SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle ho...

Malicious code in @wagni_bot/opensea (npm)

The npm package @wagnibot/opensea is a supply-chain credential stealer disguised as a OpenSea SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

Malicious code in @wagni_bot/polygon (npm)

The npm package @wagnibot/polygon is a supply-chain credential stealer disguised as a Polygon SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

Malicious code in @wagni_bot/polymarket (npm)

The npm package @wagnibot/polymarket is a supply-chain credential stealer disguised as a Polymarket SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

MAL-2026-11110 Malicious code in @wagni_bot/eth (npm)

The npm package @wagnibot/eth is a supply-chain credential stealer disguised as a Ethereum SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

Malicious code in tronsev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 74ab279920219404ed526a79d48c3e9135856fd7905a135ce506c1c148557500 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

MAL-2026-7025 Malicious code in tronsev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 74ab279920219404ed526a79d48c3e9135856fd7905a135ce506c1c148557500 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in turbom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 64978153f8a987180b6c8e88b5787598ed949a604527f0098271f97d8c66a235 Starting version 1.0.1, the package contains obfuscated code and embedded binary that is executed during the import, sharing many similarities with package...

Malicious code in manom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5c719a4493f261eac65f57909044b1f958860f46fce1668314878007d2625849 During installation, the package exfiltrates random files. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2026-6983 Malicious code in tronpak (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 35790f872dd1f0fa6c17fca434134a08101946af27a0e2b4467e3b362f618e01 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

MAL-2026-6978 Malicious code in manin (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3234643a550a8e121b7f2cbee42e45fa90604a95258babd0b8a602ee97cf3045 Package exploits dependency confusion. A beacon request is used to report usage back, but no additional information are exfiltrated. --- Category:...

MAL-2026-6979 Malicious code in turbod (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 78d60e25c1258021c4fb69a93456c76ef1157be852c7b9dc7165290ca599b0f7 Starting version 1.0.7, the package contains obfuscated code and embedded binary that is executed during the import, sharing many similarities with package...

MAL-2026-6974 Malicious code in tronhapy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9130b2067fa138b1e6562360778bbb48be1679d6de6b170db0c2938f673a1a4b Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in tronhapy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9130b2067fa138b1e6562360778bbb48be1679d6de6b170db0c2938f673a1a4b Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in tronhap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 68bc0a9899e67f3051efaf26534a1a979b7e7ef6b7fc1b839e4083dedfec16e7 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

MAL-2026-6971 Malicious code in tronhap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 68bc0a9899e67f3051efaf26534a1a979b7e7ef6b7fc1b839e4083dedfec16e7 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in pyqt6darktheme (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8cd6d16792d681b160ae1e11b3f698d8fd3004cd6019704008ad1c649fbe6f67 Package downloads and runs a remote executable, which was found to downloads further exes and starting coine mining --- Category: MALICIOUS - The campaign has...

PYSEC-2026-1075 Malicious code in tiktoken-mcp (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of tiktoken-mcp were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials an...

Malicious code in tiktoken-mcp (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08,malicious phantom releases of tiktoken-mcp were published to PyPI using stolencredentials. The package executes a bundled JavaScript payload via the Bunruntime on import that harvests and exfiltrates credentials and...