—
PYSEC-2024-152
aiocpa 0.1.13 contains credential harvesting code
Details
aiocpa is a user-facing library for generating color gradients of text. Version 0.1.13 introduced obfuscated, malicious code targeting Crypto Pay users, forwarding client credentials to a remote Telegram bot. All versions have been removed from PyPI.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/aiocpa
No fixed version published yet for aiocpa (pip). Pin to a known-safe version or switch to an alternative.