MAL-2026-5841
Malicious code in twrap-toolkit (PyPI)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: kam193 (2308804ebaf25e3528cd82eb53bab024eb80d9944a8b60950ef348d7a5022a22) During import, package downloads and executes an obfuscated script. The code then adds a new authorized SSH key and reports back the IP of the current environment. After that, the code also attempts to exfiltrate cryptocurrency wallet data
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-06-textwrap-toolkit-stager
Reasons (based on the campaign):
- backdoor
- obfuscation
- crypto-related
- Downloads and executes a remote malicious script.
- exfiltration-crypto
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for twrap-toolkit (pip). Pin to a known-safe version or switch to an alternative.