Malicious code in crypto-trading-toolkit (PyPI)

Overview

-= Per source details. Do not edit below this line.=-

Source: kam193 (20c37efbefbfb1922a205d954cdb5666103fd3e343a67e89dc19694ad5b64ef0)

During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-bip39-py

Reasons (based on the campaign):

• crypto-related

• The package overrides the install command in setup.py to execute malicious code during installation.

• exfiltration-crypto

• exfiltration-browser-data

• exfiltration-env-variables

• exfiltration-ssh-keys

• exfiltration-credentials

• uses-telegram-bot

Affected packages

• crypto-trading-toolkit

Remediation

Refer to the advisory for the patched release.