🛡️ MAL-2026-10192 — defi-tools

⚪ Unknown ✅ No Known Exploit OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Malicious code in defi-tools (PyPI)

Source: amazon-inspector

On first import, defi_tools/__init__.py decodes a base64-embedded ~486KB Linux ELF, writes it to ~/.config/.npm-cache/snapd-network, sets mode 0777, and installs a user crontab entry (0 */12 * * *) to re-execute it every 12 hours. The binary is disguised under a system-service-like name in a hidden.npm-cache directory that maps to no real npm or snapd path. The init code then recursively removes the package's own dist-info/egg-info and __pycache__ directories, erasing evidence while the dropped binary and cron entry persist.

Source: kam193

The package embeds an executable stealing cryptocurrency wallets data. During import, code saves the executable under a name suggesting system utility and configures cron to run it periodically. The exfiltrated data is encrypted using embedded RSA code before uploading to file-sharing services or IPFS.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-py-base58

Reasons (based on the campaign):

  • crypto-related
  • exfiltration-crypto
  • persistence

Affected software

MAL-2026-10192 is recorded against 1 package.

  • defi-tools

Timeline and source

Published on 12 July 2026 and last revised on 13 July 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

www.virustotal.com (Evidence)
bad-packages.kam193.eu (Web)
pypi.org (Package)

Details

Severity Unknown
CVSS Score N/A
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2026-07-12
Updated 2026-08-12
Modified 2026-07-13
Fix URL N/A

Affected Packages

Software From version Fixed in
defi-tools — —

Similar Threats

Free Vulnerability Check

Is your site affected by MAL-2026-10192?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against MAL-2026-10192 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.