{"id":"GHSA-4f84-67cv-qrv3","title":"A single post-release of dydx-v4-client contained obfuscated multi-stage loader","summary":"A single post-release of dydx-v4-client contained obfuscated multi-stage loader","severity":"critical","vendor":"dydx-v4-client","product":"dydx-v4-client","ecosystem":"pip","affected":["dydx-v4-client >= 1.1.5.post1, < 1.1.5"],"patched":["dydx-v4-client 1.1.5"],"published":"2026-02-06","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:34.127000093Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-4f84-67cv-qrv3","references":[{"url":"https://github.com/lenktn/lenktn-dydx-v4-python"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/dydx-v4-client/PYSEC-2026-1.yaml"},{"url":"https://inspector.pypi.io/project/dydx-v4-client/1.1.5.post1/packages/4b/06/4d848676e932b0fc9d707bb78603dc76555141cc832819cd1e5077bdf2a2/dydx_v4_client-1.1.5.post1.tar.gz/dydx_v4_client-1.1.5.post1/dydx_v4_client/_bootstrap.py#line.18"}],"tags":["osv","pip"],"ingestedAt":"2026-09-12T03:13:01.652Z","slug":"GHSA-4f84-67cv-qrv3","body":"## Overview\n\nA PyPI user account compromised by an attacker and was able to upload a malicious version (1.1.5.post1) of the `dydx-v4-client` package. This version contains a highly obfuscated multi-stage loader that ultimately executes malicious code on the host system.\n\nWhile the final payload is not visible because it is tucked away inside 100 layers of encoding, the structural design—specifically the use of recursive decompression followed by an `exec()` call is a definitive indicator of malicious software, likely a \"Crypter\" or \"Dropper\" masquerading as a cryptocurrency-related utility with the intent on connecting to hxxps://dydx[.]priceoracle[.]site/py\nto download and execute further payloads.\n\nUsers of the `dydx-v4-client` package should immediately uninstall version 1.1.5.post1and revert to the last known good version (1.1.5) or later secure versions once available. Additionally, users should monitor their systems for any unusual activity and consider running security scans to detect any potential compromise.\n\n## Affected packages\n\n- `dydx-v4-client >= 1.1.5.post1, < 1.1.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `dydx-v4-client 1.1.5`","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}