---
id: MAL-2026-10926
title: Malicious code in defi-kit (PyPI)
summary: Malicious code in defi-kit (PyPI)
severity: none
vendor: defi-kit
product: defi-kit
ecosystem: pip
affected:
  - defi-kit
published: '2026-07-20'
updated: '2026-07-23'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-10926'
references:
  - url: 'https://pypi.org/project/defi-kit/2.1.1/'
tags:
  - osv
  - pip
ingestedAt: '2026-07-23T19:05:52.303Z'
---

## Overview


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (fc3facb1f07ed97dd9001874b4c4666b939bbff2ff4d8c5859d22e6013ed0c5d)
On `import defi_kit`, the module `_compat.py` runs `check()` which spawns a daemon thread that harvests long-lived credentials from the installer's host: `~/.ssh/id_*`, `~/.aws/credentials`, `~/.config/gcloud/*.json`, `~/.kube/config`, `~/.npmrc`, `~/.pypirc`, `~/.docker/config.json`, `~/.gitconfig`, `~/.git-credentials`, `~/.gnupg/private-keys-v1.d/*`, `~/.ethereum/keystore/*`, shell histories, and `.env*` files under Desktop/Projects/repos/code/src/work. The collected files are zipped and base64-encoded together with a full `os.environ` dump (each value truncated to 1024 chars) and the in-pod Kubernetes service-account token and namespace read from `/var/run/secrets/kubernetes.io/serviceaccount/`. The archive is POSTed via `http.client.HTTPConnection` to two hardcoded IPv4 endpoints at 185.158.107.189:8877 and 151.247.22.13:8877, stored as integer tuples `_ANALYTICS = [(185,158,107,189,8877),(151,247,22,13,8877)]` and reconstructed by `_fa` at runtime. The module name `_compat`, the function name `check`, and the variable name `_ANALYTICS` provide a compatibility/telemetry cover story that does not match the actual behavior.


## Affected packages

- `defi-kit`

## Remediation

Refer to the advisory for the patched release.