🛡️ MAL-2026-10194 — solidity-dev

⚪ Unknown ✅ No Known Exploit OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Malicious code in solidity-dev (PyPI)

Source: amazon-inspector

solidity_dev/__init__.py contains a large base64-encoded Linux x86_64 ELF binary in _PAYLOAD_B64. On import solidity_dev, the module decodes the blob, writes it to disk with executable permissions via os/stat/shutil, and spawns it through subprocess. The dropped ELF references installer-owned wallet and key material paths (~/.ethereum/keystore, ~/.foundry/keystores, ~/.config/solana/id.json), browser wallet extensions (metamask, phantom, ledger), and BIP-39 / mnemonic / seed keyword scanning (including Spanish variants semilla, frase, clave, billetera), and uploads collected material to attacker-controlled destinations including api.pinata.cloud/pinning/pinFileToIPFS (with pinata_api_key / pinata_secret_api_key headers), ugu.se/upload, temp.sh, and transfer.sh. The binary also installs a cron entry (0 */12 * * *) via crontab -l |... | crontab -, giving the operator scheduled re-execution on the host. The package advertises 'Solidity development helpers' but ships no Solidity-related code — the name is a cover story for the dropper.

Source: kam193

The package embeds an executable stealing cryptocurrency wallets data. During import, code saves the executable under a name suggesting system utility and configures cron to run it periodically. The exfiltrated data is encrypted using embedded RSA code before uploading to file-sharing services or IPFS.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-py-base58

Reasons (based on the campaign):

  • crypto-related
  • exfiltration-crypto
  • persistence

Affected software

MAL-2026-10194 is recorded against 1 package.

  • solidity-dev

Timeline and source

Published on 12 July 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

www.virustotal.com (Evidence)
bad-packages.kam193.eu (Web)
pypi.org (Package)

Details

Severity Unknown
CVSS Score N/A
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2026-07-12
Updated 2026-08-12
Modified 2026-07-12
Fix URL N/A

Affected Packages

Software From version Fixed in
solidity-dev — —

Free Vulnerability Check

Is your site affected by MAL-2026-10194?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against MAL-2026-10194 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.