MAL-2026-162

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/btcli-security/MAL-2026-162.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-162

Published

2026-01-08T10:55:10Z

Modified

2026-01-08T11:54:17.475281Z

Summary

Malicious code in btcli-security (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (a4b868f818b1a81f5fccee1967f70c3ff9d75c218d14ec09882c576a9c2c213e)

Package clones a legitimate bittensor-cli library and adds a hidden code that downloads a malicious script. The script then downloads an archive with malicious executable in the version appropriate to the system architecture, and ensures persistency by adding automatically started service entries. The remote code is a Go-based inforstealer and backdoor previously attributed to Northkorean cybercrime activities. Additionally, the library is modified to save sensitive keys in plaintext for further extraction

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-01-gztensor-cli

Reasons (based on the campaign):

crypto-related
action-hidden-in-lib-usage
Downloads and executes a remote executable.
clones-real-package
peristence-autorun
typosquatting
obfuscation
backdoor
infostealer

Database specific

{
    "malicious-packages-origins": [
        {
            "import_time": "2026-01-08T11:37:55.902536891Z",
            "modified_time": "2026-01-08T10:55:10.111128Z",
            "source": "kam193",
            "versions": [
                "1.1.0",
                "1.1.1",
                "1.1.2"
            ],
            "sha256": "a4b868f818b1a81f5fccee1967f70c3ff9d75c218d14ec09882c576a9c2c213e",
            "id": "pypi/2026-01-gztensor-cli/btcli-security"
        }
    ],
    "iocs": {
        "urls": [
            "https://bitensor.xyz/realtek.sh"
        ],
        "domains": [
            "bitensor.xyz",
            "cameradriver.pro"
        ],
        "ips": [
            "23.227.203.99"
        ]
    }
}

References

Credits

- Kamil Mańkowski (kam193) - REPORTER
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / btcli-security

Package

Name: btcli-security; View open source insights on deps.dev
Purl: pkg:pypi/btcli-security

Affected ranges

Affected versions

1.*

1.1.0

1.1.1

1.1.2

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/btcli-security/MAL-2026-162.json"