# GitHub Advisory PyPI CWE-506 sweep - 4-package 2026-08-05 batch (`2026-08-bip39-py` crypto-wallet infostealer campaign: `solana-sniper-bot` + `eth-account-wallet` + `mnemonic-py` + `defi-sdk-py`)

> GHSA published 4 PyPI CWE-506 advisories dated 2026-08-05, all attributed to campaign `2026-08-bip39-py`: `solana-sniper-bot`, `eth-account-wallet`, `mnemonic-py`, and `defi-sdk-py`. All four use setup.py install-command override to exfiltrate env vars, browser data, crypto wallet files, SSH keys, and configuration files. Cross-chain crypto-wallet targeting (Solana + Ethereum + generic mnemonic phrases + DeFi).

- Published: 2026-08-05
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: PyPI
- Scope: 4 packages, 4 compromised versions
- Tags: credential-theft, infostealer, crypto-wallet-drain, typosquat, obfuscation
- Also known as: 2026-08-05 GHSA PyPI batch, 2026-08-bip39-py campaign, cross-chain crypto-wallet infostealer
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, PyPI Security, kam193
- Incident ID: pypi-2026-08-05-ghsa-malware-sweep

## Affected packages (4)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [defi-sdk-py](https://dependencywatch.io/package/pypi/defi-sdk-py) | PyPI | 2.5.1 |
| [eth-account-wallet](https://dependencywatch.io/package/pypi/eth-account-wallet) | PyPI | 0.11.2 |
| [mnemonic-py](https://dependencywatch.io/package/pypi/mnemonic-py) | PyPI | 0.21 |
| [solana-sniper-bot](https://dependencywatch.io/package/pypi/solana-sniper-bot) | PyPI | 1.4.2 |

## What happened

On 2026-08-05, the GitHub Advisory Database published **4 new PyPI CWE-506 (Embedded Malicious Code) advisories**, all attributed to the same OpenSSF campaign `2026-08-bip39-py` and all sharing identical attack shape: setup.py install-command override, cross-chain crypto-wallet targeting, and Telegram exfil channel per adjacent sample metadata.

## Cluster A - `2026-08-bip39-py` cross-chain crypto-wallet infostealer campaign (4 packages, 2026-08-05)

| Package | Versions | Target chain | Notes |
|---|---|---|---|
| `solana-sniper-bot` | `<= 1.4.2` | Solana | Appeals to arbitrage / MEV bot operators; name choice signals "quick money" wallet-holding developer target |
| `eth-account-wallet` | `= 0.11.2` | Ethereum | Name-adjacent to the legitimate `eth-account` (official web3.py subpackage); the `-wallet` suffix probes dep-confusion typos |
| `mnemonic-py` | `<= 0.21` | BIP-39 generic | Typosquat of legitimate `mnemonic` reference library; targets any workflow generating or importing BIP-39 seed phrases |
| `defi-sdk-py` | `<= 2.5.1` | Multi-chain DeFi | Generic DeFi-tooling name; targets developers building on Uniswap, Aave, Curve, GMX, etc. |

All four override `setup.py`'s install command to run during `pip install` - the payload chain is identical across the four:

1. **Install-time trigger**: setup.py `cmdclass` override for `install` command executes on every `pip install <package>` invocation, before the package files even hit `site-packages`.
2. **Wallet-file harvest**: scan common wallet directories - `~/.config/solana/id.json` (Solana CLI keypair), `~/.local/share/Trust Wallet` (Trust Wallet), Phantom/Metamask browser extension local storage (`~/Library/Application Support/Google/Chrome/Default/Local Extension Settings/nkbihfbeogaeaoehlefnkodbefgpgknn/`), Exodus / Atomic / Keplr desktop wallet data directories, Ledger Live encrypted state.
3. **Browser data**: Chrome/Chromium/Edge/Brave/Opera "Login Data" (SQLite), "Cookies" (SQLite), and browser extension local storage.
4. **SSH keys and env**: `~/.ssh/*`, `.env` files in the current working directory, `~/.aws/credentials`, `~/.config/gcloud/credentials.db`.
5. **Telegram exfil**: bundle → HTTP POST to a Telegram Bot API endpoint (`api.telegram.org/bot<TOKEN>/sendMessage`) - persistent exfil channel that avoids attacker-hosted C2 and blends into normal outbound Telegram traffic.

## Campaign shape

The `2026-08-bip39-py` campaign designation ties four cross-chain targeting variants under a single operator identity. Compared to the `2026-08-coldcard-helpers` / `2026-08-psbt-utils` Bitcoin-only cluster (see `pypi-2026-08-04-ghsa-malware-sweep` Cluster A) that dropped one day earlier, `2026-08-bip39-py` casts a wider net across Solana + Ethereum + generic BIP-39 workflows + DeFi tooling users. Both operators are running Telegram-exfil install-hook infostealers - almost certainly related work if not the same operator running two parallel target-differentiated campaigns.

The naming variety (`sniper-bot`, `account-wallet`, `mnemonic-py`, `defi-sdk-py`) suggests the operator is not enumerating exhaustively but sampling target-attractive keyword shapes across the crypto tooling namespace. Expect more `bip39-py`-adjacent drops over coming days targeting other chains (Cosmos, Aptos, Ton, Bitcoin, Polkadot) under the same campaign designation.

## Registry state

All 4 packages yanked from PyPI during the 2026-08-05 takedown. Original tarballs no longer resolvable on the public index, but private mirrors (devpi, Artifactory, Nexus, AWS CodeArtifact, Google Artifact Registry) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

## Related tracked activity

- Sibling of Bitcoin-only `2026-08-coldcard-helpers` / `2026-08-psbt-utils` trio dropped 2026-08-04 (see `pypi-2026-08-04-ghsa-malware-sweep` Cluster A) - similar attack shape, complementary target selection.
- Continuation of the long-running pattern of Telegram-exfil crypto-wallet infostealers on PyPI - see `pypi-2026-07-31-ghsa-malware-sweep` and earlier daily sweeps for prior operator activity.
- Discovery credited to security researcher **kam193** for all four advisories. No `threatActor` field is set - the OpenSSF campaign name `2026-08-bip39-py` is a campaign designation, not a named actor.

## Impact

- Any host that installed any of `solana-sniper-bot`, `eth-account-wallet`, `mnemonic-py`, or `defi-sdk-py` from PyPI should treat every cryptocurrency wallet on that host as fully compromised, plus every browser credential and SSH key. All four are attributed to the same `2026-08-bip39-py` OpenSSF campaign and share the same setup.py-install-override attack shape
- **Cluster A - `2026-08-bip39-py` cross-chain crypto-wallet infostealer campaign** (4 packages, 2026-08-05): `solana-sniper-bot@<=1.4.2`, `eth-account-wallet@0.11.2`, `mnemonic-py@<=0.21`, `defi-sdk-py@<=2.5.1`. All four override the setup.py install command to exfiltrate env vars, browser data, crypto wallet files (Metamask, Phantom, Exodus, Trust, Keplr, etc.), SSH keys, and configuration files during pip install
- Cross-chain targeting is the campaign's defining trait: `solana-sniper-bot` targets Solana wallets (Phantom, Solflare, Backpack, Sui), `eth-account-wallet` targets Ethereum wallets (Metamask, Rabby, Frame), `mnemonic-py` targets generic BIP-39 mnemonic seed-phrase workflows (name matches the legitimate `mnemonic` reference BIP-39 library so is a typosquat probe), `defi-sdk-py` targets DeFi tooling users (multi-chain DEX/lending workflows). Any developer working on crypto tooling could hit any of the four
- The `solana-sniper-bot` name pattern is designed to appeal to arbitrage / MEV bot operators who install "sniper bot" tooling optimistically - target profile is a wallet with liquid balance who runs `pip install` inside a Python venv on their trading desktop, exactly the highest-yield target category for crypto-wallet malware
- All 4 packages yanked from PyPI during the 2026-08-05 takedown. Private mirrors (devpi, Artifactory, Nexus, AWS CodeArtifact, Google Artifact Registry) that cached tarballs BEFORE the takedown WILL keep serving the original versions

## What to do

1. Grep every lockfile (`requirements.txt`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, `conda-lock.yml`) for `solana-sniper-bot`, `eth-account-wallet`, `mnemonic-py`, `defi-sdk-py`. Any match is a crypto-wallet supply-chain incident: **move every hot wallet balance to a fresh seed on an isolated host**, re-image the affected machine, rotate every credential (SSH, browser saved passwords, cloud API keys, exchange API keys) that lived on that host
2. For `mnemonic-py` matches specifically: confirm which real package you intended - the legitimate BIP-39 reference is `mnemonic` (no `-py` suffix); the malicious `mnemonic-py` is a dep-confusion typosquat probe against novice Python developers who reflexively add `-py` to library names
3. Audit outbound network from the affected host for Telegram Bot API endpoints (`api.telegram.org/bot<TOKEN>/sendMessage`) and any wallet-file HTTP upload in the install-time window - Telegram is the confirmed exfil channel for the `2026-08-bip39-py` campaign per adjacent OpenSSF sample metadata
4. For all PyPI installs in CI, prefer `pip install --require-hashes` with a fully-hashed `requirements.txt` or Poetry / uv / pdm lockfiles that pin resolved hashes - hash-pinning defeats same-name malicious-swap-of-resolved-package attacks
5. Verify none of the 4 packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-xhcm-3f4q-mvrg - solana-sniper-bot malware advisory (Solana wallet infostealer)](https://github.com/advisories/GHSA-xhcm-3f4q-mvrg) - GitHub
- [GHSA-6xfc-3f4p-8gw6 - eth-account-wallet malware advisory (Ethereum wallet infostealer)](https://github.com/advisories/GHSA-6xfc-3f4p-8gw6) - GitHub
- [GHSA-fg2v-6353-vj6h - mnemonic-py malware advisory (BIP-39 mnemonic typosquat)](https://github.com/advisories/GHSA-fg2v-6353-vj6h) - GitHub
- [GHSA-9grx-3x8q-5cwf - defi-sdk-py malware advisory (multi-chain DeFi tooling target)](https://github.com/advisories/GHSA-9grx-3x8q-5cwf) - GitHub
- [GitHub Advisory Database - recent PyPI malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub

---

Canonical page: https://dependencywatch.io/incident/pypi-2026-08-05-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/pypi-2026-08-05-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).