GitHub Advisory PyPI CWE-506 sweep - 10-package 2026-08-07 batch (`2026-08-alphalend-layouts` Sui keystore-stealer pair with PTH persistence + `2026-08-flasq` typosquat wave: `pydanticc`+`flasq`+`idnna`+`fastapii`+`fast-hashes`+`speed-hashes` crypto-wallet stealers + `cdktn-provider-azurerm` cdktf HashiCorp jsii-chain typosquat + `atlas-internal` dep-confusion recon)

What happened

On 2026-08-07, the GitHub Advisory Database published 10 new PyPI CWE-506 (Embedded Malicious Code) advisories across three clusters. The alphalend-* pair uses PTH file abuse for post-uninstall persistence and GitHub-repo exfil - the more interesting technical drop. Six additional advisories publish late in the day form the 2026-08-flasq typosquat wave of crypto-wallet stealers, and two singletons (cdktn-provider-azurerm, atlas-internal) cover HashiCorp-typosquat and dep-confusion recon respectively.

Cluster A - 2026-08-alphalend-layouts Sui keystore-stealer with PTH file persistence (2 packages, 2026-08-07)

| Package | Versions | Masquerade | Notes | |---|---|---|---| | alphalend-layouts | 4.0.0, 4.0.1, 4.0.2, 4.1.0 | BCS layouts library for Sui | Sui keystores + env vars, PTH persistence, GitHub-PUT exfil | | alphalend-abi | 1.0.0, 1.0.1, 1.1.0 | ABI helper for AlphaLend | Same payload, sibling package |

Behaviour chain per GHSA-q799-9mw8-2wv3 and GHSA-22gg-4p2c-546g:

1. Install-time trigger: on pip install alphalend-* the payload harvests Sui cryptocurrency keystores (~/.sui/sui_config/sui.keystore and equivalent config paths) and environment variables.
2. PTH file persistence: writes a malicious .pth file to site-packages. Python's site module auto-executes any Python code in a .pth file (any line beginning with import in a .pth file is executed at interpreter startup) - so the harvest routine runs on every future python invocation on that machine, even after pip uninstall alphalend-* removes the primary package directory. This is a known Python-runtime persistence trick and defeats naive "just uninstall the package" remediation.
3. GitHub PUT exfil: exfiltrated data is uploaded via HTTP PUT to an attacker-controlled GitHub repository. Obfuscated GitHub authentication tokens split across configuration files and source code are used to evade static-scanner detection (no single string looks like a GitHub PAT).
4. Masquerade shell: the packages ship non-functional layouts and abi Python surfaces that mimic real BCS / ABI helper libraries so a developer importing the module gets an ImportError or a no-op function rather than an obvious crash - allowing the persistence and exfil to run to completion before the developer notices anything is wrong.

Target profile - AlphaLend on Sui

The naming targets the Sui blockchain developer / user ecosystem. AlphaLend is a real Sui-native lending protocol; alphalend-layouts and alphalend-abi read as plausibly-real Python-side tooling that a Sui developer building a bot, analytics dashboard, or on-chain monitoring tool would search for. Sui keystores hold Ed25519 or ECDSA private keys granting direct control of:

• Native SUI balance
• Staked SUI positions
• AlphaLend collateral deposits (which can be withdrawn)
• AlphaLend borrowing positions (which the attacker can max-borrow against remaining collateral before draining)
• Any Sui object owned by the address, including in-game assets, NFTs, and Cetus / Turbos LP positions

PTH file abuse - why it matters

Python's site module reads every .pth file in site-packages at interpreter startup. Historically .pth files were intended to extend sys.path (bare directory paths, one per line), but the parser has always evaluated any line starting with import as Python code - a documented behaviour dating to CPython 2.x that is widely used by tools like easy-install.pth and virtualenv for legitimate purposes.

A malicious .pth file installed alongside a package persists past pip uninstall unless the uninstall specifically removes it (setuptools/pip only clean up files the package RECORD manifest lists, and a hand-crafted post-install-written .pth can be omitted from the manifest). This is why the standard "just uninstall the malicious package" remediation is insufficient for the 2026-08-alphalend-layouts campaign - the .pth cleanup step is manual.

Cluster B - 2026-08-flasq typosquat wave (6 packages, 2026-08-07)

| Package | Versions | Mimics | OpenSSF MAL | |---|---|---|---| | pydanticc | 0.1.1, 0.1.2, 0.2.0, 0.3.0 | pydantic | MAL-2026-13489 | | flasq | 0.1.1, 0.1.2, 0.2.0, 0.3.0 | flask | MAL-2026-13487 | | idnna | 0.1.1, 0.1.2, 0.2.0, 0.3.0 | idna | MAL-2026-13488 | | fastapii | 0.1.1, 0.1.2, 0.2.0, 0.3.0 | fastapi | MAL-2026-13486 | | fast-hashes | 0.1.0 | (fake hashlib accelerator) | MAL-2026-13490 | | speed-hashes | 0.1.0 | (fake hashlib accelerator) | MAL-2026-13607 |

Behaviour per GHSA-2678-pjvc-v3wf and siblings: setup.py install-command override runs obfuscated code that downloads a remote executable and starts it, exfiltrating cryptocurrency wallet data and other credentials. Same operator behind all six per the shared 2026-08-flasq OpenSSF campaign name. The pattern - four one-letter-typo variants of the most-common Python framework names plus two *-hashes fake accelerators - is textbook opportunistic typosquat harvesting from mistyped LLM completions, Discord tutorials, and Stack Overflow copy-paste. Any Sui / crypto / trader host that ran pip install pydanticc (or the other five) has already had its wallet data harvested.

Cluster C - cdktn-provider-azurerm HashiCorp cdktf typosquat with jsii-import chain (1 package, 2026-08-07)

| Package | Version | Notes | |---|---|---| | cdktn-provider-azurerm | 17.0.0 | typosquats cdktf-provider-azurerm, forces cdktn base dep, jsii import-time RCE |

One-letter transposition of HashiCorp's real cdktf-provider-azurerm (CDK for Terraform Azure provider) - cdktf → cdktn. Registered with full fake HashiCorp branding on the PyPI project page. Force-declares the attacker-controlled cdktn package as a dependency; on first import of the provider, src/cdktn_provider_azurerm/_jsii/__init__.py executes import cdktn._jsii which runs any code shipped in the attacker-controlled cdktn base inside the installer's Python process, at import time - not install time. This is a subtler attack than the typical setup.py install-hook because it bypasses pip install --no-build-isolation and pip install --no-deps defenses that only guard install-time execution.

Cluster D - atlas-internal dep-confusion recon (1 package, 2026-08-07)

| Package | Version | Notes | |---|---|---| | atlas-internal | 1.8.1 | setup.py egg_info override, HTTP GET recon to attacker callback |

Overrides the egg_info setup.py command (unusual - most PyPI malware overrides install or develop) to run silently during install. Sends hostname + working directory + username via HTTP GET to an attacker-controlled callback. Zero user output, zero interaction required. Consistent with the standard dep-confusion "profile the target before dropping stage-2 payload" pattern - the atlas-internal name suggests probing an internal namespace where the operator expects a real private atlas-internal package to exist inside a target org.

Registry state

All 10 packages yanked from PyPI during the 2026-08-07 takedown. Original tarballs no longer resolvable on the public index, but private mirrors (devpi, Artifactory, Nexus, AWS CodeArtifact, Google Artifact Registry) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

Related tracked activity

• The 2026-08-alphalend-layouts campaign name currently designates two related packages - watch subsequent daily PyPI GHSA batches for related alphalend-*, sui-*, bcs-*, move-* variants under the same campaign umbrella.
• Sui-ecosystem targeting also visible on the npm side the same day (2026-08-06 batch, sui-migration-audit-cli + sui-graphql-client + sui-migration-audit-rules + move-bcs-codec - see npm-2026-08-06-ghsa-malware-sweep) - the Sui developer ecosystem is under coordinated cross-language attack this week.
• PTH file abuse for persistence is a technique also used by prior PyPI campaigns in 2025 but had gone quiet - its return in 2026-08-alphalend-layouts is worth watching as a resurgent TTP.
• The 2026-08-flasq typosquat wave is opportunistic single-actor harvesting - same TTP as the 2026-07-* and earlier setup.py-install crypto-stealer waves. No connection to alphalend or the singletons.
• Discovery credited to security researcher kam193 per adjacent OpenSSF sample metadata for the alphalend pair. No threatActor field is set - the OpenSSF campaign name 2026-08-alphalend-layouts is a campaign designation, not a named actor.

Affected packages (10)

Impact

• Any host that installed alphalend-layouts or alphalend-abi from PyPI should treat every Sui blockchain keystore on that host as fully compromised, plus every env-var secret the Python interpreter had access to. PTH file abuse is the critical detail: the payload runs on every subsequent Python startup even after pip uninstall of the malicious package tarball, because .pth files installed into site-packages are auto-executed by Python's site initialisation before any user code
• Cluster A - 2026-08-alphalend-layouts Sui keystore-stealer with PTH file persistence (2 packages, 2026-08-07): alphalend-layouts@4.0.0+4.0.1+4.0.2+4.1.0 masquerades as a BCS (Binary Canonical Serialization) layouts library, alphalend-abi@1.0.0+1.0.1+1.1.0 masquerades as an ABI helper. Both harvest Sui cryptocurrency keystores (~/.sui/sui_config/sui.keystore, ~/.config/sui/keystore) and env vars during install AND on every Python startup, exfiltrating to an attacker-controlled GitHub repository via HTTP PUT using obfuscated GitHub tokens split across configuration files and source code to evade static detection
• Naming targets the Sui blockchain / AlphaLend DeFi lending protocol developer ecosystem - AlphaLend is a real Sui-native lending platform. Any Sui developer copy-pasting pip install alphalend-* from a tutorial, LLM completion, or Discord channel could hit either package. Sui private keys unlock direct control of Sui assets including staked SUI, deposited AlphaLend collateral, and any position with borrowing capacity
• PTH file persistence means *detection requires inspecting `site-packages/.pth after uninstall** - pip uninstall alphalend-layouts may remove the package directory but does NOT necessarily clean up the malicious .pth file, which will keep firing the harvest routine on every future python` invocation until manually deleted
• Cluster B - 2026-08-flasq typosquat wave (6 packages, 2026-08-07): pydanticc+flasq+idnna+fastapii each shipped 4 versions (0.1.1, 0.1.2, 0.2.0, 0.3.0) mimicking top PyPI names (pydantic, flask, idna, fastapi) by adding one repeated letter. fast-hashes@0.1.0 and speed-hashes@0.1.0 shipped as fake hashlib accelerators. All six override the setup.py install command to run obfuscated code that downloads and executes a remote executable, exfiltrating cryptocurrency wallet data and other credentials. Any Python dev who mistyped a pip install request from an LLM completion, tutorial, or Stack Overflow answer would hit this batch
• Cluster C singleton - cdktn-provider-azurerm@17.0.0 (2026-08-07): typosquat of HashiCorp's real cdktf-provider-azurerm CDK-for-Terraform Azure provider (cdktf → cdktn, one-letter transposition). Force-declares the attacker-controlled cdktn package as a dependency; on first import of the provider the module runs import cdktn._jsii which executes attacker code inside the installer's Python process. Full fake HashiCorp branding on the PyPI project page
• Cluster D singleton - atlas-internal@1.8.1 (2026-08-07): dep-confusion reconnaissance package. Overrides setup.py egg_info to silently HTTP-GET hostname + username + cwd to an attacker callback during install (no user interaction, no output). Consistent with the standard "profile the target before dropping stage-2 payload" tradecraft
• All 10 packages yanked from PyPI during the 2026-08-07 takedown. Private mirrors that cached tarballs BEFORE the takedown WILL keep serving the original versions

What to do

1. 1Grep every lockfile (requirements.txt, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda-lock.yml) for alphalend-layouts, alphalend-abi, pydanticc, flasq, idnna, fastapii, fast-hashes, speed-hashes, cdktn-provider-azurerm, and atlas-internal. Any match on the alphalend pair is a Sui keystore compromise: move every Sui asset to a fresh wallet on an isolated host (transfer SUI, unstake, close AlphaLend positions, revoke any signed sponsored-transaction authorities). Do NOT reuse any address that shared a keystore with the compromised host
2. 2For matches on the 2026-08-flasq typosquat cluster (pydanticc, flasq, idnna, fastapii, fast-hashes, speed-hashes): rotate every cryptocurrency wallet whose keystore/seed lived on the affected host - MetaMask, Phantom, Electrum, Ledger Live cache, Exodus, and any browser-extension wallet. The remote executable is fetched at install time and its exact behaviour can rotate, so also treat env-var secrets on the host as compromised. Fix the mistyped import in requirements.txt / your LLM prompts to the correct upstream (pydantic / flask / idna / fastapi)
3. 3For cdktn-provider-azurerm matches: uninstall the package AND the auto-declared cdktn transitive; audit any Terraform provider caches, Azure-CLI tokens, and CI runner credentials that lived on the host that first imported the provider. Fix the mistyped requirement to HashiCorp's real cdktf-provider-azurerm
4. 4For atlas-internal matches: hostname + username + cwd already sent to the operator. Treat as dep-confusion scope disclosure: the attacker now knows the target org has an internal atlas-internal namespace and will follow up with a stage-2 payload under a matching name. Configure .npmrc/pip index-url scope-to-registry mapping so atlas-internal resolves only from the private mirror
5. 5Critical PTH cleanup: after uninstalling the malicious packages, scan site-packages for orphan .pth files: find $(python -c "import site; print(*site.getsitepackages())") -name "*.pth" -newer /tmp/reference_timestamp -exec cat {} \; and inspect each entry. Any .pth file that contains import statements or exec() calls beyond a bare sys.path extension is malicious - delete it directly. Reinstall the affected Python environment from a fresh virtualenv if any orphan .pth is found
6. 6Rotate GitHub tokens that lived in env vars on the compromised host - the exfil channel is HTTP PUT to an attacker-controlled GitHub repository, so the operator has demonstrated GitHub-API tooling and may pivot to any GitHub token they harvested
7. 7Audit outbound network from the affected host for HTTP PUT requests to api.github.com/repos/*/contents/* and raw.githubusercontent.com in the install-time window and every subsequent Python-startup window - that is the confirmed exfil channel
8. 8For all PyPI installs in CI, prefer pip install --require-hashes with a fully-hashed requirements.txt or Poetry / uv / pdm lockfiles that pin resolved hashes - hash-pinning defeats same-name malicious-swap-of-resolved-package attacks
9. 9Verify neither package still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

• GHSA-q799-9mw8-2wv3 - alphalend-layouts malware advisory (Sui keystore-stealer, PTH persistence, GitHub PUT exfil)

  github.com
  GitHub
• GHSA-22gg-4p2c-546g - alphalend-abi malware advisory (sibling package, same campaign)

  github.com
  GitHub
• GHSA-2678-pjvc-v3wf - pydanticc malware advisory (2026-08-flasq typosquat wave)

  github.com
  GitHub
• GHSA-6gvf-7rvp-929m - flasq malware advisory (2026-08-flasq typosquat wave)

  github.com
  GitHub
• GHSA-wp5p-rpw9-7xxj - idnna malware advisory (2026-08-flasq typosquat wave)

  github.com
  GitHub
• GHSA-623m-8qff-qjw8 - fastapii malware advisory (2026-08-flasq typosquat wave)

  github.com
  GitHub
• GHSA-jmww-p7fc-wmqh - fast-hashes malware advisory (2026-08-flasq typosquat wave)

  github.com
  GitHub
• GHSA-86h3-9rp7-fxxc - speed-hashes malware advisory (2026-08-flasq typosquat wave)

  github.com
  GitHub
• GHSA-698f-qxc2-w6p4 - cdktn-provider-azurerm HashiCorp cdktf typosquat with jsii-import chain

  github.com
  GitHub
• GHSA-xjf2-85x6-fwr4 - atlas-internal dep-confusion recon malware advisory

  github.com
  GitHub
• GitHub Advisory Database - recent PyPI malware advisories

  github.com
  GitHub