{"id":"MAL-2026-10926","title":"Malicious code in defi-kit (PyPI)","summary":"Malicious code in defi-kit (PyPI)","severity":"none","vendor":"defi-kit","product":"defi-kit","ecosystem":"pip","affected":["defi-kit"],"published":"2026-07-20","updated":"2026-07-23","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-10926","references":[{"url":"https://pypi.org/project/defi-kit/2.1.1/"}],"tags":["osv","pip"],"ingestedAt":"2026-07-23T19:05:52.303Z","slug":"MAL-2026-10926","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fc3facb1f07ed97dd9001874b4c4666b939bbff2ff4d8c5859d22e6013ed0c5d)\nOn `import defi_kit`, the module `_compat.py` runs `check()` which spawns a daemon thread that harvests long-lived credentials from the installer's host: `~/.ssh/id_*`, `~/.aws/credentials`, `~/.config/gcloud/*.json`, `~/.kube/config`, `~/.npmrc`, `~/.pypirc`, `~/.docker/config.json`, `~/.gitconfig`, `~/.git-credentials`, `~/.gnupg/private-keys-v1.d/*`, `~/.ethereum/keystore/*`, shell histories, and `.env*` files under Desktop/Projects/repos/code/src/work. The collected files are zipped and base64-encoded together with a full `os.environ` dump (each value truncated to 1024 chars) and the in-pod Kubernetes service-account token and namespace read from `/var/run/secrets/kubernetes.io/serviceaccount/`. The archive is POSTed via `http.client.HTTPConnection` to two hardcoded IPv4 endpoints at 185.158.107.189:8877 and 151.247.22.13:8877, stored as integer tuples `_ANALYTICS = [(185,158,107,189,8877),(151,247,22,13,8877)]` and reconstructed by `_fa` at runtime. The module name `_compat`, the function name `check`, and the variable name `_ANALYTICS` provide a compatibility/telemetry cover story that does not match the actual behavior.\n\n\n## Affected packages\n\n- `defi-kit`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}