MAL-2026-13681

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/btcflip/MAL-2026-13681.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13681
Published
2026-08-10T05:21:14Z
Modified
2026-08-10T12:04:59.649256039Z
Summary
Malicious code in btcflip (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e4271f738e49ead6113a249ca949232cad9664db210319a097b56385b1942970)

The package advertises itself as an HTTP speed-up library, but on import it archives the user's Monero wallet directory (C:\Users<user>\Documents\Monero on Windows, /home/<user>/Monero on Linux) and uploads the archive to a hardcoded Telegram bot via api.telegram.org/bot<token>/sendDocument (chatid -5044692933). The destination bot token and wallet paths are stored as base64 blobs (constants TK, XMRWIN, XMR_LINUX) and decoded at runtime to conceal the exfiltration target. The exfil routine is invoked at module top level, so any import btcflip (which loads the inner kotoraka module) triggers wallet theft. The code also terminates feather/monero processes to release file locks before archiving. The stated purpose of the package is unrelated to Monero wallets and is a cover story for wallet theft.

Source: kam193 (2b305ae4851e877fcea4950e019342d31782bde7e3c49d11847e2ede65776f78)

During import, the package exfiltrates cryptocurrency wallet files.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-kotanku

Reasons (based on the campaign):

  • exfiltration-crypto

  • uses-telegram-bot

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-08-kotanku/btcflip",
            "import_time": "2026-08-10T06:38:36.536152009Z",
            "sha256": "2b305ae4851e877fcea4950e019342d31782bde7e3c49d11847e2ede65776f78",
            "modified_time": "2026-08-10T05:21:14.020182Z",
            "versions": [
                "0.1.0"
            ],
            "source": "kam193"
        },
        {
            "versions": [
                "0.1.0"
            ],
            "import_time": "2026-08-10T11:51:55.15387373Z",
            "sha256": "e4271f738e49ead6113a249ca949232cad9664db210319a097b56385b1942970",
            "modified_time": "2026-08-10T11:50:48Z",
            "id": "IN-MAL-2026-017210",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

PyPI / btcflip

Package

Name
btcflip
View open source insights on deps.dev
Purl
pkg:pypi/btcflip

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "md5": "cddecd603b55b8fbd272de0732d27a10",
                "sha256": "04f93b85bc9d1ef85e7ee9eb581f5c20c63c760e4c6e460473934426a70575e7",
                "blake2b_256": "f25eb14e2b94ecfc3fe598595f7edb4bec462c4b279ed0e88e70ff31307e6aed"
            },
            "filename": "btcflip-0.1.0-py3-none-any.whl"
        },
        {
            "hashes": {
                "md5": "5c889271d9dc0b34715359963a907312",
                "sha256": "a7c84dafeec36de00cfacfb73b0e7d74f00c509581a41e5a604b810a90ef68d2",
                "blake2b_256": "22bafc8d72f8cc8d32eb258b28c03cce912d641942fb8e0eb4db6160eb9837d8"
            },
            "filename": "btcflip-0.1.0.tar.gz"
        }
    ],
    "evidence_files": [
        {
            "path": "kotoraka/__init__.py",
            "sha256": "1f9b92b37899ca0f6f2edbffb3fa425a43e8927256f04fb5966be265b08bd8e2",
            "tlsh": "a351f24ede6a440451b1938e2dc194b2c705326b6e10952f7ebc4a80afb08a6d672b7f"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/btcflip/MAL-2026-13681.json"