DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
CriticalPublished 10 Aug 2026Updated 11 Aug 202611 packages · 20 versions

GitHub Advisory PyPI CWE-506 sweep - 2026-08-09..2026-08-11 batch (`neutrl-core`+`neutrl-contracts`+`plp-contract` credential-stealing dep-hidden campaign 2026-08-neutrl-core, `kotanku`+`kotoraka`+`btcflx`+`btcflip` Telegram-bot wallet-file exfiltrator quartet 2026-08-kotanku campaign, `pytablute` 2025-11-spellcheckers multi-stage RCE + polling C2, `chaintest` DPRK Contagious-Interview-adjacent browser+wallet+clipboard+SSH-key infostealer, `bigtime` open()-hook file-write exfiltrator 2026-08-bigtime campaign, `cubesat-upstream-driver` env-var reconnaissance dep-confusion PROBABLY_PENTEST)

Summary

11 PyPI CWE-506 advisories published 2026-08-09..2026-08-11 across four named campaigns: 2026-08-neutrl-core hides credential theft in an intentional malicious dependency (fake backdated GitHub history); 2026-08-kotanku ships four Telegram-bot cryptocurrency-wallet-file exfiltrators (kotanku, kotoraka, btcflx, btcflip); 2025-11-spellcheckers multi-stage RCE lands as pytablute; chaintest is a DPRK "Contagious Interview"-adjacent full-spectrum stealer.

credential-theftinfostealercrypto-wallet-draindependency-confusionobfuscation
Threat actor
DPRK / Famous Chollima (Contagious Interview family, per advisory attribution on `chaintest`)
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis · PyPI Security · Aikido
Also known as
2026-08-neutrl-core · 2026-08-kotanku · 2025-11-spellcheckers · 2026-08-bigtime · Contagious Interview Aug-10 wave
Ecosystems
PyPI
Packages tracked
11

What happened

On 2026-08-09 through 2026-08-11, the GitHub Advisory Database published 11 new PyPI CWE-506 (Embedded Malicious Code) advisories across four distinct named campaigns plus two standalone drops. The batch is unusually campaign-rich for a mid-week PyPI sweep: 2026-08-neutrl-core, 2026-08-kotanku, 2025-11-spellcheckers, chaintest / Contagious Interview family, and 2026-08-bigtime each represent a coordinated operator - not a single-package one-off.

Cluster A - 2026-08-neutrl-core dep-hidden credential-theft campaign (3 packages, 2026-08-10)

| Package | Version | GHSA | Role | |---|---|---|---| | neutrl-core | 2.0.0, 2.0.1, 2.0.2 | GHSA-mphw-49c2-f7hr | Payload carrier | | neutrl-contracts | 2.0.0, 2.0.1, 2.0.2 | GHSA-w82v-c64w-j8f5 | Intentional dependent (transitive install of the payload) | | plp-contract | 2.0.0, 2.0.1, 2.0.2 | GHSA-4crr-q8rh-wqrg | Intentional dependent (transitive install of the payload) |

Payload: exfiltrates environment variables, SSH keys, dotenv files, and other credentials, disguised inside what looks like telemetry code. Ensures its own C2 endpoint remains in the configuration regardless of user-provided blockchain endpoints (a defensive-tampering-resistance measure).

Trust-heuristic evasion: the operator established a fake GitHub account with backdated commits, giving the appearance of legitimate long-running project history. This defeats "does this maintainer exist / has this repo been around a while" evaluation heuristics. Naming (neutrl = Neutron / DeFi-adjacent, plp-contract = liquidity-pool contract) targets a specific DeFi protocol's internal namespace, consistent with the sustained dep-confusion pressure Russian and Asian financial-institution internal scopes have seen throughout Q2/Q3 2026.

Cluster B - 2026-08-kotanku Telegram-bot wallet-file exfiltrator quartet (4 packages, 2026-08-09..2026-08-10)

| Package | Version | GHSA | Published | |---|---|---|---| | kotanku (namesake) | 0.1.0 | GHSA-q2fv-xh5f-cfmx | 2026-08-09 | | kotoraka | 0.1.0 | GHSA-hmfw-wq6f-f2ph | 2026-08-10 | | btcflx | 0.1.0 | GHSA-wvgr-r9rh-2fqv | 2026-08-10 | | btcflip | 0.1.0 | GHSA-f6qg-475c-wmpp | 2026-08-10 |

All four exfiltrate cryptocurrency wallet files during import and beacon via a Telegram bot for C2. Naming morphology (btcflx/btcflip, kotanku/kotoraka) suggests an Indonesian/Southeast-Asian crypto-trading tooling target register ("kota" = city, "toko" = shop; typical Indonesian package-name morphology).

Cluster C - 2025-11-spellcheckers multi-stage RCE campaign continuation (1 package, 2026-08-10)

| Package | Versions | GHSA | Campaign | |---|---|---|---| | pytablute | <=1.0.3 | GHSA-p4h7-5jh2-3rpc | 2025-11-spellcheckers |

Downloads and executes a remote malicious script on library import/use; spawns a persistent background process that periodically polls remote C2 for shell commands. The 2025-11-spellcheckers campaign has been a long-running crypto/RAT operator visible in PyPI since November 2025, historically shipping typosquat-adjacent names in the spellcheck / text-utility space.

Cluster D - chaintest DPRK Contagious-Interview-adjacent full-spectrum stealer (1 package, 2026-08-10)

| Package | Version | GHSA | Attributed family | |---|---|---|---| | chaintest | 0.1.0 | GHSA-6qc6-vp88-49gp | DPRK Contagious Interview (July 2026 similarity, per advisory text) |

Widest capability set in the batch: browser data + cryptowallet extensions + synced extensions + local storage + password managers + standalone cryptowallets; clipboard hooked to swap copied cryptocurrency addresses; keylogger; multi-OS persistence; C2-fetched shell commands; SSH-key theft; malicious browser extension installation. Advisory text explicitly cites behavioural similarity to the DPRK-attributed "Contagious Interview" campaign from July 2026 - same tooling family previously seen in the 2026-04-07 contagious-interview 5-ecosystem drop and the 2026-02-27 stegabin contagious-interview. The Contagious Interview / Famous Chollima operator specifically targets developer / crypto-industry hires via fake interview processes and coding assignments that include a malicious dependency.

Cluster E - bigtime open()-hook file-write exfiltrator (1 package, 2026-08-11)

| Package | Version | GHSA | Campaign | |---|---|---|---| | bigtime | 0.1.0 | GHSA-28hg-x9rg-9j9w | 2026-08-bigtime |

Novel exfiltration primitive: monkey-patches Python's built-in open() function to intercept and exfiltrate every file-write operation. Plus attaches an exfiltration watcher to files in the user's home directory. Highest-signal defensive coverage warning: because open() is patched at import time, any subsequent file write anywhere in the process - including secret rotation, config emission, log writes, and Python-based install scripts running in the same interpreter - is captured and exfiltrated in-flight. Rotate-then-continue-in-the-same-process is not a valid remediation path for hosts that ran bigtime.

Cluster F - cubesat-upstream-driver env-var reconnaissance dep-confusion (PROBABLY_PENTEST) (1 package, 2026-08-09)

| Package | Version | GHSA | Classification | |---|---|---|---| | cubesat-upstream-driver | 1.0.1 | GHSA-xjgc-gwrp-p632 | PROBABLY_PENTEST |

Collects up to all environment variables but does not exfiltrate on its own. Advisory classifies as PROBABLY_PENTEST (pen-test / CTF exercise, low inherent harm). Naming targets a cubesat-scoped internal namespace - plausibly an aerospace / satellite / space-industry target org. Detected by Aikido. Even without automatic exfil, the env dump lives on disk pending a stage-2 trigger.

Registry state

All 11 packages yanked or security-holding-replaced from PyPI during the takedown window. Private mirrors (Artifactory, Nexus, private PyPI clones) that cached wheels before the takedown will keep serving the malicious versions.

Related tracked activity

  • Contagious Interview / Famous Chollima register: chaintest (Cluster D) is the third distinct Contagious Interview family drop tracked here - see also 2026-04-07 multi-ecosystem drop, 2026-02-27 stegabin.
  • Aug 2026 npm/PyPI supply-chain pressure: this PyPI sweep runs concurrent with the CHAINDROP-adjacent 2026-08-04 keyv/cacheable Shai-Hulud worm and the 2026-08-10 npm CWE-506 sweep (46 npm advisories including the on-chain Ethereum RPC dead-drop loader pair).
  • Discovery credits: OpenSSF malicious-packages, OpenSSF Package Analysis, PyPI Security, Aikido (specifically credited on cubesat-upstream-driver). No named threat actor - campaign identifiers 2026-08-neutrl-core, 2026-08-kotanku, 2025-11-spellcheckers, 2026-08-bigtime.

Affected packages (11)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check requirements.txt

Impact

  • Cluster A - 2026-08-neutrl-core dep-hidden credential-theft campaign (3 packages, 2026-08-10): neutrl-core@2.0.0..2.0.2 carries the actual payload; neutrl-contracts and plp-contract (both 2.0.0..2.0.2) intentionally depend on neutrl-core so their install pulls the payload in transitively. Payload exfiltrates environment variables, SSH keys, dotenv files, and other credentials, disguised inside what looks like telemetry code. Malware ensures its own C2 endpoint remains in the configuration regardless of user-provided blockchain endpoints. The operator established a fake GitHub account with backdated commits to fabricate legitimate project history - specifically designed to defeat "does the maintainer exist / has this repo been around a while" trust heuristics. Blockchain-industry-targeted naming (neutrl, plp-contract) suggests the operator is enumerating a specific DeFi protocol's internal namespace
  • Cluster B - 2026-08-kotanku Telegram-bot wallet-file exfiltrator quartet (4 packages, 2026-08-09..2026-08-10): kotanku@0.1.0 (campaign namesake), kotoraka@0.1.0, btcflx@0.1.0, btcflip@0.1.0. All four exfiltrate cryptocurrency wallet files during import and beacon via a Telegram bot for C2. Naming pattern (btcflx / btcflip, kotanku / kotoraka) suggests a small typosquat scheme aimed at Indonesian/Southeast-Asian crypto-trading tooling ("kota" = city, "toko" = shop; typical Indonesian package-name morphology). Any host that installed and imported any of the four during the exposure window must be assumed to have exfiltrated every wallet file readable to the executing user
  • Cluster C - 2025-11-spellcheckers multi-stage RCE campaign continuation (1 package pytablute@<=1.0.3, 2026-08-10): downloads and executes a remote malicious script on library import/use, spawns a persistent background process that periodically polls remote C2 for shell commands. Same campaign as prior 2025-11-spellcheckers pypi drops (long-running crypto/RAT campaign; the campaign name refers to spellcheck-utility-adjacent typosquat naming that debuted in November 2025). Multi-stage - the current advisory captures only stage 1; stage 2 is fetched at runtime and can rotate silently
  • Cluster D - chaintest DPRK Contagious-Interview-adjacent full-spectrum stealer (1 package chaintest@0.1.0, 2026-08-10): exfiltrates browser data (cryptowallet extensions, synced extensions, local storage), standalone password managers, standalone cryptowallets; hooks clipboard to swap copied cryptocurrency addresses to attacker wallets; keylogs; establishes multi-OS persistence; prepared to fetch and execute C2 commands; steals SSH keys; can install malicious browser extensions. The advisory explicitly notes behavioural similarity to the DPRK-attributed "Contagious Interview" campaign from July 2026 - the same tooling family previously seen in the 2026-04-07 contagious-interview 5-ecosystem drop and the 2026-02-27 stegabin contagious-interview. Any Windows/macOS/Linux host that installed chaintest must be treated as fully compromised at OS + browser + wallet + clipboard + credential levels
  • Cluster E - bigtime open()-hook file-write exfiltrator (1 package bigtime@0.1.0, 2026-08-11 - the freshest advisory in the batch): monkey-patches Python's built-in open() function to intercept and exfiltrate every file-write operation, plus attaches an exfiltration watcher to files in the user's home directory. Campaign name 2026-08-bigtime. High-signal defensive coverage warning: because the built-in open() is patched at import time, any subsequent file write anywhere in the process - including secret rotation, config-file emission, log writes, and Python-based install scripts - is captured and exfiltrated in-flight
  • Cluster F - cubesat-upstream-driver env-var reconnaissance dep-confusion (PROBABLY_PENTEST-classified) (1 package cubesat-upstream-driver@1.0.1, 2026-08-09): collects up to all environment variables but does not exfiltrate them on its own. Advisory classifies as PROBABLY_PENTEST (a pen-test / CTF exercise, low inherent harm). Naming suggests a cubesat-scoped internal-package dep-confusion attempt against an aerospace / satellite target org. Even without automatic exfil, the collected env dump lives on disk pending a stage-2 trigger; treat any match as an internal-scope exposure until the target org confirms authorised testing

What to do

  1. 1Grep every Python requirements file (requirements.txt, Pipfile.lock, poetry.lock, uv.lock, pdm.lock) for the full 2026-08-09..2026-08-11 package list below
  2. 2For neutrl-core, neutrl-contracts, or plp-contract matches (Cluster A - dep-hidden credential theft): assume every SSH key, environment variable, and dotenv file readable to the install user has been exfiltrated. Rotate every credential accessible to the affected host. Because neutrl-core is a transitive dependency of neutrl-contracts / plp-contract, the direct-dependency grep is insufficient - resolve your full transitive tree and grep for neutrl-core at any depth. If you operate in DeFi / blockchain infrastructure and see a suspicious internal neutrl-* package, escalate to internal security - this operator is enumerating DeFi internal namespaces with fake backdated GitHub identities designed to pass trust heuristics
  3. 3For kotanku, kotoraka, btcflx, or btcflip matches (Cluster B - wallet-file exfiltrators): every cryptocurrency wallet file readable to the executing user has been exfiltrated to the operator's Telegram bot. Move any remaining balance out of every exposed wallet immediately, revoke every private key stored on the host, and audit on-chain flows for sweeps from your addresses
  4. 4For pytablute matches (Cluster C - 2025-11-spellcheckers RCE): kill any long-running Python process spawned as a background child of the install, block outbound to the stage-2 C2 hosts referenced in the advisory, re-image the affected host, and rotate every credential. The multi-stage design means the payload captured in the advisory may differ from the payload that ran on your host
  5. 5For chaintest matches (Cluster D - Contagious-Interview-adjacent full stealer): highest-severity remediation of the batch. Any host that installed chaintest is compromised at every level: browser data + password managers + cryptowallets + clipboard hooked + keylogger installed + persistence established + SSH keys stolen. Re-image the host from bare metal, rotate every credential ever entered on the host, drain every cryptocurrency wallet, verify no rogue browser extensions were installed on any browser profile, and (if the host is a developer workstation) treat every commit signed from it during the exposure window as needing review. Cross-reference against the DPRK "Contagious Interview" tooling family - this operator specifically targets developer / crypto-industry hires via fake interview processes
  6. 6For bigtime matches (Cluster E - 2026-08-bigtime file-write hook): because open() was patched at import time, every file written by the Python process during the exposure window - including credential-rotation output, config emission, and log writes - has been exfiltrated in-flight. Rotate every credential written by the process, and audit outbound flow logs for the file-content exfil pattern (small POSTs correlated with file .write() timing)
  7. 7For cubesat-upstream-driver matches (Cluster F - PROBABLY_PENTEST env dump): even if the advisory classifies as pen-test, the env-dump is now present on the host and can be triggered later. Delete the dump artifact, configure .npmrc-equivalent (--index-url / pip.conf index-url / PIP_INDEX_URL) scope-to-registry mapping so cubesat-* internal names resolve only from your private mirror, and check whether an authorised red-team exercise is running before treating this as an incident
  8. 8For all Python installs in CI, prefer isolated build environments and pinned lockfiles - transitively-installed malicious dependencies (Cluster A) evade direct-dependency review
  9. 9Verify none of the 2026-08-09..2026-08-11 packages still resolves via your private PyPI mirror

References

Back to feedSubmit a correction
pypi-2026-08-10-ghsa-malware-sweep