Malicious code in axiom-dragon-xyz (PyPI)

Source: kam193 7bb0be864a1e4a0a1e01ae4fa900052bf2f74c57f9d7ed40b4fae48caa84e746 During installation package exfiltrates sensitive files used by cryptocurrency wallets and storing cloud credentials. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in axiom-dragon-xyz (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4ce1e726810b4fb8b80ccf673b1101c68ee68fa7ee8c8ae92e4c12ba75c779a setup.py defines a custom install cmdclass PostInstall that runs execbase64.b64decode....decode during pip install. The decoded payload enumerates...

MAL-2026-19289 Malicious code in axiom-dragon-xyz (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4ce1e726810b4fb8b80ccf673b1101c68ee68fa7ee8c8ae92e4c12ba75c779a setup.py defines a custom install cmdclass PostInstall that runs execbase64.b64decode....decode during pip install. The decoded payload enumerates...

Malicious code in dictmerge-lite (PyPI)

dictmerge-lite 1.0.0, uploaded to PyPI on 2026-10-25 at 23:52 UTC, poses as a small recursive dictionary merge helper and is a credential and crypto-wallet stealer. Importing the package runs the payload: dictmergelite/init.py imports telemetry and starts telemetry.runasync, a non-daemon thread s...

Malicious code in sherpy (PyPI)

Source: kam193 2e5440f1e24545fd14e73c7fc459a9abf893f4674683899ed29ff7c4189416b6 When used, the package exfiltrates Chrome extension files likely targeting cryptocurrency wallets and sensitive Telegram files. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2026-17188 Malicious code in sherpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 561bac708df60298c46df70c27282912b3955ec3fd83a23e251c268e814cdcbf The sherpy package presents itself as an OSINT command-line tool but ships all of its logic inside a 10.8 MB precompiled PyO3 native module at...

MAL-2026-13682 Malicious code in btcflx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 839c411e8d33badaebd5e59b2d966dc000e631843a49ce9352caafd1b7dd9e12 Package advertises itself as an HTTP speed-up library but on import of the top-level module unconditionally locates the user's Monero wallet director...

MAL-2026-13681 Malicious code in btcflip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4271f738e49ead6113a249ca949232cad9664db210319a097b56385b1942970 The package advertises itself as an HTTP speed-up library, but on import it archives the user's Monero wallet directory C:\Users\Documents\Monero on...

Malicious code in kotanku (PyPI)

Source: kam193 2281ff1cf735f26084f13f5f3ef5e1d5f9faf8cf06254532e5ee6d27204f52d1 During import, the package exfiltrates cryptocurrency wallet files. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-kotanku Reasons based on the campaign: -...

Malicious code in idnna (PyPI)

Source: kam193 c3caa6af02ad3844d721b93e94796fed92506f24517c3b990d741b147eee5acf Package imitates name of a popula library. During installation, obfuscated code downloads a malicious executable and starts it. It then exfiltrates at least cryptocurrency wallet data, probably more. --- Category:...

Malicious code in fastapii (PyPI)

Source: kam193 ccfc3dd07e620dc6bda1b28b4d8f77932ee217aff579270c0e0c74453e215943 Package imitates name of a popula library. During installation, obfuscated code downloads a malicious executable and starts it. It then exfiltrates at least cryptocurrency wallet data, probably more. --- Category:...

MAL-2026-13487 Malicious code in flasq (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79bdf17d9c07586ddc0b7121037c2c10019d7be01d2dd49685680a8e876342c6 setup.py registers a custom install cmdclass whose post-install hook is stored as a base64-encoded blob and decoded+exec'd at install time. On Linux,...

MAL-2026-13472 Malicious code in alphalend-abi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1650b24020e22aac89835e5b8a20b7de20f6479a2ce311d35dd56ab3dc4d6bb1 During import, the package exfiltrates sensitive files with SUI private keys to a private GitHub repository. This action is also triggered on every Python...

MAL-2026-13362 Malicious code in mnemonic-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6599d6208d71e0e809661e86bf5641e6e7b871cd6f01a54abf22215b8a88ef11 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in bip39-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c188f84ee0ad8238ed89a94673968e9f17c44d91d25dfe8012efd39e01705081 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

MAL-2026-11094 Malicious code in cfgzen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a904eba641878bae63f76595a468b0faaa66fd27104ac557249e457f005c3fb1 The package installs a site-wide cfgzen.pth containing import dotcfg, which Python's site machinery executes automatically at every interpreter start...

Malicious code in karpatkey (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b434ae7cf6afb9ce18a54757c03069983e404db695d959bd29aa628864b8349c On import karpatkey, the top-level karpatkey/init.py spawns a daemon background thread that walks the installer's home directory and collects SSH...

Malicious code in web3-tool-sdk (PyPI)

Source: kam193 9b0a2f82214baa91e572e7e7081cc863c213321d2a1f69cace704ce9b4a33e70 The code automatically scans the filesystem looking for BIP-39 seed phrases and data indicating private keys, and exfiltrates them --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in web3automation (PyPI)

Source: kam193 09a3fb2947bb8eaaf1e65033e8ccee659633669d5de0c0456b4c2e1680317dfb Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency private keys, e.g...

Malicious code in web3-helper (PyPI)

Source: kam193 8b4b0ec18a585bcc92bfeea9cf5e3febdd7d540f38f78cb1acc62ce33784a492 The code automatically scans the filesystem looking for BIP-39 seed phrases and data indicating private keys, and exfiltrates them --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...