{"id":"MAL-2026-13473","title":"Malicious code in alphalend-layouts (PyPI)","summary":"Malicious code in alphalend-layouts (PyPI)","severity":"none","vendor":"alphalend-layouts","product":"alphalend-layouts","ecosystem":"pip","affected":["alphalend-layouts"],"published":"2026-08-06","updated":"2026-08-06","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-13473","references":[{"url":"https://pypi.org/project/alphalend-layouts/4.1.0/"},{"url":"https://pypi.org/project/alphalend-layouts/4.0.1/"},{"url":"https://pypi.org/project/alphalend-layouts/4.0.0/"},{"url":"https://pypi.org/project/alphalend-layouts/4.0.2/"},{"url":"https://bad-packages.kam193.eu/pypi/package/alphalend-layouts"}],"tags":["osv","pip"],"ingestedAt":"2026-08-07T19:14:15.078Z","slug":"MAL-2026-13473","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fddd94a1329de9e53295705e2344e18fc7c3620804cbb3cda3c81e7ba0e7727e)\nThe package harvests installer-side secrets and uploads them to an attacker-controlled GitHub repository, executing both when `pip install alphalend-layouts` runs (via custom `install`/`develop` cmdclass subclasses in setup.py that invoke `_compat._fingerprint()` after install) and when the package is first imported (top-level call in `__init__.py`). `_candidate_files()` reads `~/.sui/sui.keystore`, `~/.sui/sui_config/*.yaml`/`client.yaml`, and `.env*` files filtered by the markers `SUI_`, `PK_B64`, and `PRIVATE_KEY`. `_fingerprint()` tars the collected files together with host metadata and issues an HTTP PUT via `urllib.request` to `https://api.github.com/repos/futongwan/sui-research-notes/contents/fingerprints/<ts>-<pid>.tar.gz`. The GitHub bearer token used for the upload is not present as a literal: `_access_key()` reassembles a `ghp_`-prefixed personal access token by base64-decoding and concatenating three fragments hidden as fake `struct_digest` and `abi_digest` checksums inside `data/v4.json` plus a `_COMPAT_TAG` constant in `_compat.py`. Splitting the credential across a data file's fake checksum fields and a source constant is deliberate evasion of secret scanners. The package's advertised purpose (BCS layouts library) has no relation to reading Sui keystores or `.env` secrets or uploading archives to a third-party GitHub repository.\n\n## Source: kam193 (8d74ce87fa7ee35368ff21a8009d0fd553b9cf301ef1aa1bd2ffb8d683bbb778)\nDuring import, the package exfiltrates sensitive files with SUI private keys to a private GitHub repository. This action is also triggered on every Python startup due to leveraging PTH files.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-alphalend-layouts\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n\n\n - obfuscation\n\n\n - crypto-related\n\n\n - exfiltration-crypto\n\n\n - abuses-pth\n\n\n## Affected packages\n\n- `alphalend-layouts`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}