MAL-2025-3437

    Dashboard / Malicious Package / MAL-2025-3437

    MAL-2025-3437

    Published: 30 Mar 2025Last Modified: 12 Dec 2025Aliases: 
    SNYK-PYTHON-BITCOINLIBDBFIX-9667328

    Summary: Malicious code in bitcoinlibdbfix (PyPI)

    Details: Source: kam193 (a5cb52fa4f2ac6a68416c59a513399e01bb388d5e238260b712a513db3d97233) It overwrites the 'clw' command from legit bitconinlib package and attempts to exfiltrate its database on the usage. As a context, it appears to be created to lure users seeking for help with the bitconinlib package: https://github.com/1200wd/bitcoinlib/issues/455#issuecomment-2764513104 Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-03-bitcoinlibdbfix Reasons (based on the campaign): - files-exfiltration - crypto-related - action-hidden-in-lib-usage - exfiltration-crypto

    References: https://security.snyk.io/vuln/SNYK-PYTHON-BITCOINLIBDBFIX-9667328, https://www.reversinglabs.com/blog/malicious-python-packages-target-popular-bitcoin-library, https://github.com/1200wd/bitcoinlib/issues/455#issuecomment-2764513104, https://bad-packages.kam193.eu/pypi/package/bitcoinlibdbfix

    Affected packages

    Package

    Name: bitcoinlibdbfix

    Purl: pkg:pypi/bitcoinlibdbfix

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.4.8
    0.4.9
    0.4.10
    0.4.11
    0.4.12
    0.4.13
    0.4.14
    MAL-2025-3437 | CVE-DB