Malicious code in coldcard-helpers (PyPI)

Overview

-= Per source details. Do not edit below this line.=-

Source: kam193 (127a096109f7b5b2bbedf7f6a9fc2e7baa706e93704ebd52615e744a9838fbc3)

When installing the package or importing the module, code starts a background task collecting sensitive data, like sensitive environment variables, private keys for cryptocurrency wallets, SSH keys, and so on to a Telegram channel.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-coldcard-helpers

Reasons (based on the campaign):

• exfiltration-env-variables

• exfiltration-ssh-keys

• exfiltration-crypto

• exfiltration-credentials

• uses-telegram-bot

• The package overrides the install command in setup.py to execute malicious code during installation.

Affected packages

• coldcard-helpers

Remediation

Refer to the advisory for the patched release.