MAL-2025-3436

    Dashboard / Malicious Package / MAL-2025-3436

    MAL-2025-3436

    Published: 30 Mar 2025Last Modified: 12 Dec 2025Aliases: 
    SNYK-PYTHON-BITCOINLIBDEV-9667327

    Summary: Malicious code in bitcoinlib-dev (PyPI)

    Details: Source: kam193 (a198ee5e2df9c67dcbd24ed19a8fec5d462bbb3c0eb474cf00cd299e75074ef5) It overwrites the 'clw' command from legit bitconinlib package and attempts to exfiltrate its database on the usage. As a context, it appears to be created to lure users seeking for help with the bitconinlib package: https://github.com/1200wd/bitcoinlib/issues/455#issuecomment-2764513104 Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-03-bitcoinlibdbfix Reasons (based on the campaign): - files-exfiltration - crypto-related - action-hidden-in-lib-usage - exfiltration-crypto

    References: https://www.reversinglabs.com/blog/malicious-python-packages-target-popular-bitcoin-library, https://security.snyk.io/vuln/SNYK-PYTHON-BITCOINLIBDEV-9667327, https://github.com/1200wd/bitcoinlib/issues/455#issuecomment-2764513104, https://bad-packages.kam193.eu/pypi/package/bitcoinlib-dev

    Affected packages

    Package

    Name: bitcoinlib-dev

    Purl: pkg:pypi/bitcoinlib-dev

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.4.16
    0.4.17
    0.4.18
    0.4.19
    0.4.20
    0.4.21
    MAL-2025-3436 | CVE-DB