Malware in cb-wallet-data

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview cb-wallet-data is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in speed-hashes (PyPI)

Source: amazon-inspector 120e6126065bccc254b925a6913422c0cbdd201054437820369c2726fd4a2871 setup.py defines a custom install command NativeInstall that runs on pip install. After the normal install step, a base64 literal COMPATPAYLOAD is decoded and passed to execcompile... under cover-story names...

Malicious code in speed-hashes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 120e6126065bccc254b925a6913422c0cbdd201054437820369c2726fd4a2871 setup.py defines a custom install command NativeInstall that runs on pip install. After the normal install step, a base64 literal COMPATPAYLOAD is...

Malicious code in pydanticc (PyPI)

Source: kam193 c16b176d1ba6ee3f4f1680d0678c9933e620f4de18bec7bc9af67978ed737527 Package imitates name of a popula library. During installation, obfuscated code downloads a malicious executable and starts it. It then exfiltrates at least cryptocurrency wallet data, probably more. --- Category:...

Malicious code in flasq (PyPI)

Source: kam193 2498f9d207b216ad7438cd262c9136cc5453d288f97a74d4cd44a9a2accf9141 Package imitates name of a popula library. During installation, obfuscated code downloads a malicious executable and starts it. It then exfiltrates at least cryptocurrency wallet data, probably more. --- Category:...

MAL-2026-13488 Malicious code in idnna (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da6f2ec3b09fbcf061a9f4ffefe1c179983ad8cdc0af705f2218280ade3c1da3 The package publishes under a name that closely resembles the widely-used idna package and advertises itself as 'HTTP client utilities', but the only...

Malicious code in fastapii (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf67e733322de0ce3d08269697e6ccd9460233319cadd5f97f05c8d1e855665a fastapii 0.1.2 is a single-character typosquat of the popular fastapi package. Its setup.py registers a custom setuptools install cmdclass LinuxInsta...

MAL-2026-13486 Malicious code in fastapii (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf67e733322de0ce3d08269697e6ccd9460233319cadd5f97f05c8d1e855665a fastapii 0.1.2 is a single-character typosquat of the popular fastapi package. Its setup.py registers a custom setuptools install cmdclass LinuxInsta...

Malicious code in flasq (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79bdf17d9c07586ddc0b7121037c2c10019d7be01d2dd49685680a8e876342c6 setup.py registers a custom install cmdclass whose post-install hook is stored as a base64-encoded blob and decoded+exec'd at install time. On Linux,...

MAL-2026-12387 Malicious code in gekko-mev-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86b8b89beb9e8245f1a13fbaf7fc18719f0b87c12bba7e7dcaf3321e7127020e The package presents itself as an Ethereum MEV bot, but bin/gekko-bot.js silently spawns lib/stealth.js as a detached, stdio-ignored background child...

Malicious code in gekko-mev-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86b8b89beb9e8245f1a13fbaf7fc18719f0b87c12bba7e7dcaf3321e7127020e The package presents itself as an Ethereum MEV bot, but bin/gekko-bot.js silently spawns lib/stealth.js as a detached, stdio-ignored background child...

Malicious code in @zzzgenesis00/bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcabff22bb09847474002e52ef9e8101a847fe662fcf18eec0617fd6e9829e20 This package is a typosquat of the bitcoinjs-wallet ecosystem. Its index.js is a thin passthrough while the malicious behavior is in postinstall.js,...

MAL-2026-12121 Malicious code in @zzzgenesis00/hd-key-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d1bce1ae0778169c4e5fb37721dfcc052c984efc60a257166adb4d20e2d39e5 @zzzgenesis00/hd-key-generator ships a postinstall.js that runs automatically on npm install. It enumerates /.ssh, /.npmrc, /.gitconfig, browser...

MAL-2026-12087 Malicious code in @wethenorth12/bitcoin-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34ac8cc76bddd60e41e530c9bb7cc74d902d3cb21a551db409bfdcac50a99cb8 On require, index.js reads the entire process.env plus host identifiers hostname, username, homedir, platform, cwd, timestamp, JSON-stringifies and...

Malicious code in python-bitcoinlib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfb9c83260c4fb83a678636e1e1c028f2aff3e3c0a0ac13728cfa2056a13389f This npm package, published under the well-known PyPI name python-bitcoinlib, ships a postinstall.js lifecycle script that runs automatically on npm...

MAL-2026-12112 Malicious code in mnemonic-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc209736a2c44e541e224030a4c0bd7145bb77a17fa66504cd96beedc75ce6f4 index.js executes an IIFE at require-time that reads installer-owned secret files .env,.npmrc, /.aws/credentials, /.ssh/idrsa, ided25519, idecdsa,...

Malicious code in @zzzgenesis00/bip39-mnemonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f370f7bfdab3817c323daee33d8de48e5171c41dad3f1bff2f1335e04a65060 Package impersonates the bitcoinjs/bip39 project author field set to 'bitcoinjs-lib' and ships a postinstall.js that runs on npm install. The script...

MAL-2026-12030 Malicious code in @zzzgenesis00/bip39-mnemonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f370f7bfdab3817c323daee33d8de48e5171c41dad3f1bff2f1335e04a65060 Package impersonates the bitcoinjs/bip39 project author field set to 'bitcoinjs-lib' and ships a postinstall.js that runs on npm install. The script...

Malicious code in approval-guardian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71875c984aab2d8335b3efdd1b107d7adbd4c3cbd6309278b6804c8162bdca87 The package presents itself as an on-chain approval scanner but on CLI invocation runs a silent credential harvester. src/index.js scan walks the...