MAL-2026-4259

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/cryptowallet-safety/MAL-2026-4259.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4259
Published
2026-05-22T20:30:44Z
Modified
2026-05-26T06:03:09.212566027Z
Summary
Malicious code in cryptowallet-safety (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (276a350e78e2602882e107586e33d617b3e392e3943c120d99d4213963d7fd9d)

On import cryptowallet_safety, the top-level __init__.py (lines 13-21) shells out to curl -sL https://ddjidd564.github.io/defi-security-best-practices/payloads/wallet-safety-check.js and pipes the response body directly into node -e for execution. The fetch is unpinned (mutable URL on a personal github.io site, not the package publisher's domain), unverified (no hash or signature check), executed in an alternate runtime (Node) bypassing Python install-phase sandboxes such as pip download / pip wheel / build isolation, and errors are swallowed silently. Any developer or CI system that imports this package executes whatever JavaScript the github.io account currently serves — content the attacker can change at any time. The package self-describes as a crypto-wallet safety helper, which makes the import-time dropper especially likely to land in environments handling wallet keys.

Source: kam193 (cd2f5a911cabd7312224175b40dfeaefc3ae0b83c21747f688e608cb1afd062f)

During import, the package downloads a remote JS script that then exfiltrates environmental variables, dotenv files, cryptowallets data and other sensitive informations. It's part of a broader campaign across PyPI, NPM and Github.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-eth-security-auditor

Reasons (based on the campaign):

  • files-exfiltration

  • exfiltration-env-variables

  • crypto-related

  • Downloads and executes a remote malicious script.

  • exfiltration-crypto

  • exfiltration-credentials

Database specific 
{
    "iocs": {
        "domains": [
            "ddjidd564.github.io"
        ],
        "urls": [
            "https://ddjidd564.github.io/defi-security-best-practices/payloads/compliance-scanner-light.js",
            "https://ddjidd564.github.io/defi-security-best-practices/payloads/risk-profiler.js"
        ]
    },
    "malicious-packages-origins": [
        {
            "sha256": "cd2f5a911cabd7312224175b40dfeaefc3ae0b83c21747f688e608cb1afd062f",
            "import_time": "2026-05-22T21:55:13.06737119Z",
            "source": "kam193",
            "modified_time": "2026-05-22T21:31:52.286005Z",
            "versions": [
                "0.1.0"
            ],
            "id": "pypi/2026-05-eth-security-auditor/cryptowallet-safety"
        },
        {
            "sha256": "3a4d7d7edd75dd9ba680a5a745dd9cfb9a6807ba1402568cbfee14ac2a2b6f1c",
            "import_time": "2026-05-24T06:19:57.536326492Z",
            "source": "kam193",
            "modified_time": "2026-05-22T21:31:52.286005Z",
            "versions": [
                "0.1.0"
            ],
            "id": "pypi/2026-05-eth-security-auditor/cryptowallet-safety"
        },
        {
            "sha256": "276a350e78e2602882e107586e33d617b3e392e3943c120d99d4213963d7fd9d",
            "import_time": "2026-05-26T05:52:14.775214994Z",
            "source": "amazon-inspector",
            "modified_time": "2026-05-22T20:30:44Z",
            "versions": [
                "0.1.0"
            ],
            "id": "IN-MAL-2026-004255"
        }
    ]
}
References
Credits

Affected packages

PyPI / cryptowallet-safety

Package

Name
cryptowallet-safety
View open source insights on deps.dev
Purl
pkg:pypi/cryptowallet-safety

Affected ranges

Affected versions

0.*
0.1.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/cryptowallet-safety/MAL-2026-4259.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "2a49c49da89e10b0bc4391600857911c617f471908a8a6e0bc89b0ddd7a29bbc",
            "tlsh": "08711035583a2969f342c07e08297249625c31c37d8d3c30ba9cf15a9fec079ecb66b8",
            "path": "cryptowallet_safety/__init__.py"
        }
    ],
    "package_integrity": [
        {
            "filename": "cryptowallet_safety-0.1.0-py3-none-any.whl",
            "hashes": {
                "sha256": "ebad1e3186132b2892da38a92fb38e0e6e697e53e080adb8d2fbb899b93dc8ec",
                "md5": "c8aca73bf3eb27e25dfb67fad2a050dd",
                "blake2b_256": "e7996a5e56bb97cd47c5662c649045c1c72e6e0da11de4335ce42974dbf408cf"
            }
        }
    ]
}