Malicious code in data-harvester (PyPI)

Overview

-= Per source details. Do not edit below this line.=-

Source: kam193 (d9ff3c2a82fba71167baaab535551bcb60a32bf4eb1bdd355ef3314d493771c4)

The package embeds an executable stealing cryptocurrency wallets data. During import, code saves the executable under a name suggesting system utility and configures cron to run it periodically. The exfiltrated data is encrypted using embedded RSA code before uploading to file-sharing services or IPFS.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-py-base58

Reasons (based on the campaign):

• crypto-related

• exfiltration-crypto

• persistence

Affected packages

• data-harvester

Remediation

Refer to the advisory for the patched release.