Malicious code in trongappy (PyPI)

Source: kam193 91ef2777a3657922888663423a9cadfbad9e4366473b5c7c4e03a7608e49fa36 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some packages additionally clone the readme of other, legit...

Malicious code in trongappy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 145727605bb141edc0fa9697253b211a1b0e467db2a484a2cedd163bcc6df1b7 The package exposes a single public function permprivatekey that POSTs its privatekey argument as JSON to the hardcoded URL...

MAL-2026-16242 Malicious code in trongappy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 145727605bb141edc0fa9697253b211a1b0e467db2a484a2cedd163bcc6df1b7 The package exposes a single public function permprivatekey that POSTs its privatekey argument as JSON to the hardcoded URL...

Malicious code in trongridew (PyPI)

Source: kam193 b39b568eb2c95508c9c14eacd7c907017273e80aad0298b23a11cd0139513ec7 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some packages additionally clone the readme of other, legit...

Malicious code in trongridi (PyPI)

Source: kam193 3d03608cfdb32a163655abbfe15a2c86d5957fe498e678d3f6e3f44f12220454 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some packages additionally clone the readme of other, legit...

Malicious code in tronlinker (PyPI)

Source: kam193 18f3b8d2924d38ddd8e852a2ca3311ccb85a82a4a6eedc836c4b8086465dfaee Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some packages additionally clone the readme of other, legit...

Malicious code in trongridor (PyPI)

Source: kam193 46fcd4ed6da56295fe0a0b4a25cbaf848f10874c6905723472a57e7f59341341 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some packages additionally clone the readme of other, legit...

MAL-2026-15578 Malicious code in trongridor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46fcd4ed6da56295fe0a0b4a25cbaf848f10874c6905723472a57e7f59341341 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in trongridet (PyPI)

Source: kam193 d37e79174370b2dcd44b05ddb583e65d2e0b878033aa0702653294dc965a3483 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some packages additionally clone the readme of other, legit...

Malicious code in dlmm-sdk (PyPI)

Source: kam193 007be0fc2d53a2c72f277ddb12c24bb04ae1e17d2bf03f83b70367c3bf1b9122 During import the package exfiltrates sensitive env variables and credential files. In addition, listings of cryptocurrency wallet directories are collected. --- Category: MALICIOUS - The campaign has clearly maliciou...

MAL-2026-13472 Malicious code in alphalend-abi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1650b24020e22aac89835e5b8a20b7de20f6479a2ce311d35dd56ab3dc4d6bb1 During import, the package exfiltrates sensitive files with SUI private keys to a private GitHub repository. This action is also triggered on every Python...

MAL-2026-12080 Malicious code in bip39-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c188f84ee0ad8238ed89a94673968e9f17c44d91d25dfe8012efd39e01705081 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in psbt-helpers (PyPI)

Source: kam193 394dea9d587ac1affba13c45ecfc28f5d005b2cb5f8b665dcf4591b60085a8ae The code advertised as a firmware upgrader for hardware wallets in fact downloads an infostealer. The stealer searches the machine for cryptocurrency sensitive data wallet files, seeds, browser data passwords, cookies...

Malicious code in trongriden (PyPI)

Source: kam193 dfb2a16e0023940b622e66acf21c1597d4127d94fb730610f509960e49754c3f Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some packages additionally clone the readme of other, legit...

Malicious code in web3toolkit-base (PyPI)

Source: kam193 bdfcb6d5feffbd89fd13ed27d03b0bf7c14970f09ceeb202f8b36703fec6e907 Code monitors the clipboard and when detects a cryptocurrency wallet, attempts to overwrite it with the own address. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in web3-tool-sdk (PyPI)

Source: kam193 9b0a2f82214baa91e572e7e7081cc863c213321d2a1f69cace704ce9b4a33e70 The code automatically scans the filesystem looking for BIP-39 seed phrases and data indicating private keys, and exfiltrates them --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in web3-helper (PyPI)

Source: kam193 8b4b0ec18a585bcc92bfeea9cf5e3febdd7d540f38f78cb1acc62ce33784a492 The code automatically scans the filesystem looking for BIP-39 seed phrases and data indicating private keys, and exfiltrates them --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in web3-helpers (PyPI)

Source: kam193 8d6102ae402b2583a01da47e71f41cccba99fb7826dcf360004d8924557e1760 During installation, package exfiltrates some basic info to a GitHub issue comment, and then attempt to set up a persistent infostealer focused on exfiltrating crypto wallets and browsers data. Likely continuation of...

Malicious code in wallettron (PyPI)

Source: kam193 daa2901c8248d9a4e63be69c1595134618d563065c67a466b006d53bd92d5ce5 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some packages additionally clone the readme of other, legit...

Malicious code in wallettronpy (PyPI)

Source: kam193 6232d6f8e03368abc5a38f906502206757571193ce7daf078c26f2e0cd159882 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some packages additionally clone the readme of other, legit...