# GitHub Advisory PyPI CWE-506 sweep - 10-package 2026-08-07 batch (`2026-08-alphalend-layouts` Sui keystore-stealer pair with PTH persistence + `2026-08-flasq` typosquat wave: `pydanticc`+`flasq`+`idnna`+`fastapii`+`fast-hashes`+`speed-hashes` crypto-wallet stealers + `cdktn-provider-azurerm` cdktf HashiCorp jsii-chain typosquat + `atlas-internal` dep-confusion recon)

> GHSA published 10 PyPI CWE-506 advisories dated 2026-08-07 across three clusters: `2026-08-alphalend-layouts` Sui keystore-stealer pair with PTH file persistence (`alphalend-layouts`, `alphalend-abi`); `2026-08-flasq` typosquat wave dropping crypto-wallet stealers (`pydanticc`, `flasq`, `idnna`, `fastapii`, `fast-hashes`, `speed-hashes`); and singletons `cdktn-provider-azurerm` (HashiCorp cdktf typosquat with jsii import-time chain) and `atlas-internal` (dep-confusion recon).

- Published: 2026-08-07
- Last updated: 2026-08-08
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: PyPI
- Scope: 10 packages, 27 compromised versions
- Tags: credential-theft, infostealer, crypto-wallet-drain, typosquat, obfuscation, dependency-confusion
- Also known as: 2026-08-07 GHSA PyPI batch, 2026-08-alphalend-layouts campaign, 2026-08-flasq typosquat wave, Sui keystore PTH persistence
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, PyPI Security, kam193
- Incident ID: pypi-2026-08-07-ghsa-malware-sweep

## Affected packages (10)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [alphalend-abi](https://dependencywatch.io/package/pypi/alphalend-abi) | PyPI | 1.0.0, 1.0.1, 1.1.0 |
| [alphalend-layouts](https://dependencywatch.io/package/pypi/alphalend-layouts) | PyPI | 4.0.0, 4.0.1, 4.0.2, 4.1.0 |
| [atlas-internal](https://dependencywatch.io/package/pypi/atlas-internal) | PyPI | 1.8.1 |
| [cdktn-provider-azurerm](https://dependencywatch.io/package/pypi/cdktn-provider-azurerm) | PyPI | 17.0.0 |
| [fast-hashes](https://dependencywatch.io/package/pypi/fast-hashes) | PyPI | 0.1.0 |
| [fastapii](https://dependencywatch.io/package/pypi/fastapii) | PyPI | 0.1.1, 0.1.2, 0.2.0, 0.3.0 |
| [flasq](https://dependencywatch.io/package/pypi/flasq) | PyPI | 0.1.1, 0.1.2, 0.2.0, 0.3.0 |
| [idnna](https://dependencywatch.io/package/pypi/idnna) | PyPI | 0.1.1, 0.1.2, 0.2.0, 0.3.0 |
| [pydanticc](https://dependencywatch.io/package/pypi/pydanticc) | PyPI | 0.1.1, 0.1.2, 0.2.0, 0.3.0 |
| [speed-hashes](https://dependencywatch.io/package/pypi/speed-hashes) | PyPI | 0.1.0 |

## What happened

On 2026-08-07, the GitHub Advisory Database published **10 new PyPI CWE-506 (Embedded Malicious Code) advisories** across three clusters. The `alphalend-*` pair uses PTH file abuse for post-uninstall persistence and GitHub-repo exfil - the more interesting technical drop. Six additional advisories publish late in the day form the `2026-08-flasq` typosquat wave of crypto-wallet stealers, and two singletons (`cdktn-provider-azurerm`, `atlas-internal`) cover HashiCorp-typosquat and dep-confusion recon respectively.

## Cluster A - `2026-08-alphalend-layouts` Sui keystore-stealer with PTH file persistence (2 packages, 2026-08-07)

| Package | Versions | Masquerade | Notes |
|---|---|---|---|
| `alphalend-layouts` | `4.0.0`, `4.0.1`, `4.0.2`, `4.1.0` | BCS layouts library for Sui | Sui keystores + env vars, PTH persistence, GitHub-PUT exfil |
| `alphalend-abi` | `1.0.0`, `1.0.1`, `1.1.0` | ABI helper for AlphaLend | Same payload, sibling package |

Behaviour chain per GHSA-q799-9mw8-2wv3 and GHSA-22gg-4p2c-546g:

1. **Install-time trigger**: on `pip install alphalend-*` the payload harvests Sui cryptocurrency keystores (`~/.sui/sui_config/sui.keystore` and equivalent config paths) and environment variables.
2. **PTH file persistence**: writes a malicious `.pth` file to `site-packages`. Python's `site` module auto-executes any Python code in a `.pth` file (any line beginning with `import` in a .pth file is executed at interpreter startup) - so the harvest routine runs on **every future `python` invocation** on that machine, even after `pip uninstall alphalend-*` removes the primary package directory. This is a known Python-runtime persistence trick and defeats naive "just uninstall the package" remediation.
3. **GitHub PUT exfil**: exfiltrated data is uploaded via HTTP PUT to an attacker-controlled GitHub repository. **Obfuscated GitHub authentication tokens split across configuration files and source code** are used to evade static-scanner detection (no single string looks like a GitHub PAT).
4. **Masquerade shell**: the packages ship non-functional `layouts` and `abi` Python surfaces that mimic real BCS / ABI helper libraries so a developer importing the module gets an ImportError or a no-op function rather than an obvious crash - allowing the persistence and exfil to run to completion before the developer notices anything is wrong.

## Target profile - AlphaLend on Sui

The naming targets the **Sui blockchain** developer / user ecosystem. AlphaLend is a real Sui-native lending protocol; `alphalend-layouts` and `alphalend-abi` read as plausibly-real Python-side tooling that a Sui developer building a bot, analytics dashboard, or on-chain monitoring tool would search for. Sui keystores hold Ed25519 or ECDSA private keys granting direct control of:

- Native SUI balance
- Staked SUI positions
- AlphaLend collateral deposits (which can be withdrawn)
- AlphaLend borrowing positions (which the attacker can max-borrow against remaining collateral before draining)
- Any Sui object owned by the address, including in-game assets, NFTs, and Cetus / Turbos LP positions

## PTH file abuse - why it matters

Python's `site` module reads every `.pth` file in `site-packages` at interpreter startup. Historically `.pth` files were intended to extend `sys.path` (bare directory paths, one per line), but the parser has always evaluated any line starting with `import` as Python code - a documented behaviour dating to CPython 2.x that is widely used by tools like `easy-install.pth` and `virtualenv` for legitimate purposes.

A malicious `.pth` file installed alongside a package **persists past `pip uninstall`** unless the uninstall specifically removes it (setuptools/pip only clean up files the package RECORD manifest lists, and a hand-crafted post-install-written .pth can be omitted from the manifest). This is why the standard "just uninstall the malicious package" remediation is insufficient for the `2026-08-alphalend-layouts` campaign - the .pth cleanup step is manual.

## Cluster B - `2026-08-flasq` typosquat wave (6 packages, 2026-08-07)

| Package | Versions | Mimics | OpenSSF MAL |
|---|---|---|---|
| `pydanticc` | `0.1.1`, `0.1.2`, `0.2.0`, `0.3.0` | `pydantic` | MAL-2026-13489 |
| `flasq` | `0.1.1`, `0.1.2`, `0.2.0`, `0.3.0` | `flask` | MAL-2026-13487 |
| `idnna` | `0.1.1`, `0.1.2`, `0.2.0`, `0.3.0` | `idna` | MAL-2026-13488 |
| `fastapii` | `0.1.1`, `0.1.2`, `0.2.0`, `0.3.0` | `fastapi` | MAL-2026-13486 |
| `fast-hashes` | `0.1.0` | (fake `hashlib` accelerator) | MAL-2026-13490 |
| `speed-hashes` | `0.1.0` | (fake `hashlib` accelerator) | MAL-2026-13607 |

Behaviour per GHSA-2678-pjvc-v3wf and siblings: **`setup.py install`-command override** runs obfuscated code that downloads a remote executable and starts it, exfiltrating cryptocurrency wallet data and other credentials. Same operator behind all six per the shared `2026-08-flasq` OpenSSF campaign name. The pattern - four one-letter-typo variants of the most-common Python framework names plus two `*-hashes` fake accelerators - is textbook opportunistic typosquat harvesting from mistyped LLM completions, Discord tutorials, and Stack Overflow copy-paste. Any Sui / crypto / trader host that ran `pip install pydanticc` (or the other five) has already had its wallet data harvested.

## Cluster C - `cdktn-provider-azurerm` HashiCorp cdktf typosquat with jsii-import chain (1 package, 2026-08-07)

| Package | Version | Notes |
|---|---|---|
| `cdktn-provider-azurerm` | `17.0.0` | typosquats `cdktf-provider-azurerm`, forces `cdktn` base dep, jsii import-time RCE |

One-letter transposition of HashiCorp's real `cdktf-provider-azurerm` (CDK for Terraform Azure provider) - `cdktf` → `cdktn`. Registered with full fake HashiCorp branding on the PyPI project page. Force-declares the attacker-controlled `cdktn` package as a dependency; on first import of the provider, `src/cdktn_provider_azurerm/_jsii/__init__.py` executes `import cdktn._jsii` which runs any code shipped in the attacker-controlled `cdktn` base **inside the installer's Python process, at import time** - not install time. This is a subtler attack than the typical setup.py install-hook because it bypasses `pip install --no-build-isolation` and `pip install --no-deps` defenses that only guard install-time execution.

## Cluster D - `atlas-internal` dep-confusion recon (1 package, 2026-08-07)

| Package | Version | Notes |
|---|---|---|
| `atlas-internal` | `1.8.1` | `setup.py egg_info` override, HTTP GET recon to attacker callback |

Overrides the `egg_info` setup.py command (unusual - most PyPI malware overrides `install` or `develop`) to run silently during install. Sends hostname + working directory + username via HTTP GET to an attacker-controlled callback. Zero user output, zero interaction required. Consistent with the standard dep-confusion "profile the target before dropping stage-2 payload" pattern - the `atlas-internal` name suggests probing an internal namespace where the operator expects a real private `atlas-internal` package to exist inside a target org.

## Registry state

All 10 packages yanked from PyPI during the 2026-08-07 takedown. Original tarballs no longer resolvable on the public index, but private mirrors (devpi, Artifactory, Nexus, AWS CodeArtifact, Google Artifact Registry) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

## Related tracked activity

- The `2026-08-alphalend-layouts` campaign name currently designates two related packages - watch subsequent daily PyPI GHSA batches for related `alphalend-*`, `sui-*`, `bcs-*`, `move-*` variants under the same campaign umbrella.
- Sui-ecosystem targeting also visible on the npm side the same day (2026-08-06 batch, `sui-migration-audit-cli` + `sui-graphql-client` + `sui-migration-audit-rules` + `move-bcs-codec` - see `npm-2026-08-06-ghsa-malware-sweep`) - the Sui developer ecosystem is under coordinated cross-language attack this week.
- PTH file abuse for persistence is a technique also used by prior PyPI campaigns in 2025 but had gone quiet - its return in `2026-08-alphalend-layouts` is worth watching as a resurgent TTP.
- The `2026-08-flasq` typosquat wave is opportunistic single-actor harvesting - same TTP as the `2026-07-*` and earlier setup.py-install crypto-stealer waves. No connection to alphalend or the singletons.
- Discovery credited to security researcher `kam193` per adjacent OpenSSF sample metadata for the alphalend pair. No `threatActor` field is set - the OpenSSF campaign name `2026-08-alphalend-layouts` is a campaign designation, not a named actor.

## Impact

- Any host that installed `alphalend-layouts` or `alphalend-abi` from PyPI should treat every Sui blockchain keystore on that host as fully compromised, plus every env-var secret the Python interpreter had access to. **PTH file abuse is the critical detail**: the payload runs on every subsequent Python startup even after `pip uninstall` of the malicious package tarball, because `.pth` files installed into `site-packages` are auto-executed by Python's site initialisation before any user code
- **Cluster A - `2026-08-alphalend-layouts` Sui keystore-stealer with PTH file persistence** (2 packages, 2026-08-07): `alphalend-layouts@4.0.0`+`4.0.1`+`4.0.2`+`4.1.0` masquerades as a BCS (Binary Canonical Serialization) layouts library, `alphalend-abi@1.0.0`+`1.0.1`+`1.1.0` masquerades as an ABI helper. Both harvest **Sui cryptocurrency keystores** (`~/.sui/sui_config/sui.keystore`, `~/.config/sui/keystore`) and env vars during install AND on every Python startup, exfiltrating to an **attacker-controlled GitHub repository via HTTP PUT** using obfuscated GitHub tokens split across configuration files and source code to evade static detection
- Naming targets the **Sui blockchain / AlphaLend DeFi lending protocol** developer ecosystem - AlphaLend is a real Sui-native lending platform. Any Sui developer copy-pasting `pip install alphalend-*` from a tutorial, LLM completion, or Discord channel could hit either package. Sui private keys unlock direct control of Sui assets including staked SUI, deposited AlphaLend collateral, and any position with borrowing capacity
- PTH file persistence means **detection requires inspecting `site-packages/*.pth` after uninstall** - `pip uninstall alphalend-layouts` may remove the package directory but does NOT necessarily clean up the malicious .pth file, which will keep firing the harvest routine on every future `python` invocation until manually deleted
- **Cluster B - `2026-08-flasq` typosquat wave** (6 packages, 2026-08-07): `pydanticc`+`flasq`+`idnna`+`fastapii` each shipped 4 versions (`0.1.1`, `0.1.2`, `0.2.0`, `0.3.0`) mimicking top PyPI names (`pydantic`, `flask`, `idna`, `fastapi`) by adding one repeated letter. `fast-hashes@0.1.0` and `speed-hashes@0.1.0` shipped as fake hashlib accelerators. All six override the setup.py `install` command to run obfuscated code that **downloads and executes a remote executable**, exfiltrating **cryptocurrency wallet data and other credentials**. Any Python dev who mistyped a `pip install` request from an LLM completion, tutorial, or Stack Overflow answer would hit this batch
- **Cluster C singleton - `cdktn-provider-azurerm@17.0.0`** (2026-08-07): typosquat of HashiCorp's real `cdktf-provider-azurerm` CDK-for-Terraform Azure provider (cdktf → cdktn, one-letter transposition). Force-declares the attacker-controlled `cdktn` package as a dependency; on first import of the provider the module runs `import cdktn._jsii` which executes attacker code inside the installer's Python process. Full fake HashiCorp branding on the PyPI project page
- **Cluster D singleton - `atlas-internal@1.8.1`** (2026-08-07): dep-confusion reconnaissance package. Overrides `setup.py egg_info` to silently HTTP-GET hostname + username + cwd to an attacker callback during install (no user interaction, no output). Consistent with the standard "profile the target before dropping stage-2 payload" tradecraft
- All 10 packages yanked from PyPI during the 2026-08-07 takedown. Private mirrors that cached tarballs BEFORE the takedown WILL keep serving the original versions

## What to do

1. Grep every lockfile (`requirements.txt`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, `conda-lock.yml`) for `alphalend-layouts`, `alphalend-abi`, `pydanticc`, `flasq`, `idnna`, `fastapii`, `fast-hashes`, `speed-hashes`, `cdktn-provider-azurerm`, and `atlas-internal`. Any match on the alphalend pair is a **Sui keystore compromise**: **move every Sui asset to a fresh wallet on an isolated host** (transfer SUI, unstake, close AlphaLend positions, revoke any signed sponsored-transaction authorities). Do NOT reuse any address that shared a keystore with the compromised host
2. For matches on the `2026-08-flasq` typosquat cluster (`pydanticc`, `flasq`, `idnna`, `fastapii`, `fast-hashes`, `speed-hashes`): rotate every cryptocurrency wallet whose keystore/seed lived on the affected host - MetaMask, Phantom, Electrum, Ledger Live cache, Exodus, and any browser-extension wallet. The remote executable is fetched at install time and its exact behaviour can rotate, so also treat env-var secrets on the host as compromised. Fix the mistyped import in `requirements.txt` / your LLM prompts to the correct upstream (`pydantic` / `flask` / `idna` / `fastapi`)
3. For `cdktn-provider-azurerm` matches: uninstall the package AND the auto-declared `cdktn` transitive; audit any Terraform provider caches, Azure-CLI tokens, and CI runner credentials that lived on the host that first imported the provider. Fix the mistyped requirement to HashiCorp's real `cdktf-provider-azurerm`
4. For `atlas-internal` matches: hostname + username + cwd already sent to the operator. Treat as **dep-confusion scope disclosure**: the attacker now knows the target org has an internal `atlas-internal` namespace and will follow up with a stage-2 payload under a matching name. Configure `.npmrc`/`pip index-url` scope-to-registry mapping so `atlas-internal` resolves only from the private mirror
5. **Critical PTH cleanup**: after uninstalling the malicious packages, scan `site-packages` for orphan `.pth` files: `find $(python -c "import site; print(*site.getsitepackages())") -name "*.pth" -newer /tmp/reference_timestamp -exec cat {} \;` and inspect each entry. Any `.pth` file that contains `import` statements or `exec()` calls beyond a bare `sys.path` extension is malicious - delete it directly. Reinstall the affected Python environment from a fresh virtualenv if any orphan .pth is found
6. Rotate GitHub tokens that lived in env vars on the compromised host - the exfil channel is HTTP PUT to an attacker-controlled GitHub repository, so the operator has demonstrated GitHub-API tooling and may pivot to any GitHub token they harvested
7. Audit outbound network from the affected host for HTTP PUT requests to `api.github.com/repos/*/contents/*` and `raw.githubusercontent.com` in the install-time window and every subsequent Python-startup window - that is the confirmed exfil channel
8. For all PyPI installs in CI, prefer `pip install --require-hashes` with a fully-hashed `requirements.txt` or Poetry / uv / pdm lockfiles that pin resolved hashes - hash-pinning defeats same-name malicious-swap-of-resolved-package attacks
9. Verify neither package still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-q799-9mw8-2wv3 - alphalend-layouts malware advisory (Sui keystore-stealer, PTH persistence, GitHub PUT exfil)](https://github.com/advisories/GHSA-q799-9mw8-2wv3) - GitHub
- [GHSA-22gg-4p2c-546g - alphalend-abi malware advisory (sibling package, same campaign)](https://github.com/advisories/GHSA-22gg-4p2c-546g) - GitHub
- [GHSA-2678-pjvc-v3wf - pydanticc malware advisory (2026-08-flasq typosquat wave)](https://github.com/advisories/GHSA-2678-pjvc-v3wf) - GitHub
- [GHSA-6gvf-7rvp-929m - flasq malware advisory (2026-08-flasq typosquat wave)](https://github.com/advisories/GHSA-6gvf-7rvp-929m) - GitHub
- [GHSA-wp5p-rpw9-7xxj - idnna malware advisory (2026-08-flasq typosquat wave)](https://github.com/advisories/GHSA-wp5p-rpw9-7xxj) - GitHub
- [GHSA-623m-8qff-qjw8 - fastapii malware advisory (2026-08-flasq typosquat wave)](https://github.com/advisories/GHSA-623m-8qff-qjw8) - GitHub
- [GHSA-jmww-p7fc-wmqh - fast-hashes malware advisory (2026-08-flasq typosquat wave)](https://github.com/advisories/GHSA-jmww-p7fc-wmqh) - GitHub
- [GHSA-86h3-9rp7-fxxc - speed-hashes malware advisory (2026-08-flasq typosquat wave)](https://github.com/advisories/GHSA-86h3-9rp7-fxxc) - GitHub
- [GHSA-698f-qxc2-w6p4 - cdktn-provider-azurerm HashiCorp cdktf typosquat with jsii-import chain](https://github.com/advisories/GHSA-698f-qxc2-w6p4) - GitHub
- [GHSA-xjf2-85x6-fwr4 - atlas-internal dep-confusion recon malware advisory](https://github.com/advisories/GHSA-xjf2-85x6-fwr4) - GitHub
- [GitHub Advisory Database - recent PyPI malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub

---

Canonical page: https://dependencywatch.io/incident/pypi-2026-08-07-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/pypi-2026-08-07-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).