DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
CriticalPublished 11 Aug 20267 packages · 14 versions

GitHub Advisory PyPI CWE-506 sweep - 2026-08-11 batch (`joule-sbx-poc`+`joule-btp-extension` 2026-08-joule-btp-extension localhost-exfil + reverse-shell PROBABLY_PENTEST pair, `telebot-pro` 2026-08-telebot-pro Telegram-session hidden-thread infostealer, `euler-sdk`+`morpho-sdk` GENERIC-standard-pypi-install-pentest setup.py install-hook IP+username exfil, `dlmm-sdk`+`dlmm` 2026-08-dlmm MALICIOUS env-var + credential + crypto wallet-directory enumeration)

Summary

7 PyPI CWE-506 advisories published 2026-08-11 across four named campaigns: 2026-08-telebot-pro starts a hidden exfiltration thread that lifts Telegram session files, pictures, and connected WiFi network info; 2026-08-dlmm exfiltrates env vars + credentials + cryptocurrency wallet directory listings on import; 2026-08-joule-btp-extension + euler-sdk/morpho-sdk are PROBABLY_PENTEST setup.py install-hook recon packages targeting DeFi vendor namespaces.

credential-theftinfostealercrypto-wallet-draindependency-confusion
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis · PyPI Security · kam193 bad-packages
Also known as
2026-08-11 GHSA PyPI batch · 2026-08-telebot-pro · 2026-08-dlmm · 2026-08-joule-btp-extension · GENERIC-standard-pypi-install-pentest euler+morpho
Ecosystems
PyPI
Packages tracked
7

What happened

On 2026-08-11, the GitHub Advisory Database published 7 new PyPI CWE-506 (Embedded Malicious Code) advisories across four distinct named campaigns. The batch is smaller than the same-day npm sweep but tightly focused: three of the four campaigns target DeFi vendor namespaces (Meteora DLMM, Euler Labs, Morpho Labs, Joule Finance), plus a Telegram-tooling infostealer.

Cluster A - 2026-08-telebot-pro Telegram-session hidden-thread infostealer (1 package)

| Package | Versions | GHSA | Campaign | Classification | |---|---|---|---|---| | telebot-pro | 2.3.7, 2.3.8 | GHSA-x78w-5mq6-pmpg | 2026-08-telebot-pro | MALICIOUS (infostealer) |

Advisory text: "when the bot class is used, the code starts a hidden exfiltration thread that collects Telegram session files, pictures and information about the machine, like connected WiFi networks". Classified MALICIOUS by kam193 bad-packages, campaign identifier 2026-08-telebot-pro. Typosquats pyTelegramBotAPI (widely imported as telebot).

Because the exfiltration thread starts on class instantiate, not on import, --ignore-scripts-style measures at install time do not block it - the exfil only fires once the developer actually uses the library.

Cluster B - 2026-08-dlmm MALICIOUS env-var + credential + crypto wallet-directory enumeration (2 packages)

| Package | Versions | GHSA | Campaign | Classification | |---|---|---|---|---| | dlmm-sdk | >=1.0.0 (1.0.0) | GHSA-jp82-pmg9-xvj9 | 2026-08-dlmm | MALICIOUS | | dlmm | >=1.0.0 (1.0.0) | GHSA-5gh8-34vp-xw63 | 2026-08-dlmm | MALICIOUS |

On import, exfiltrates:

  1. Sensitive environment variables matching credential patterns.
  2. Credential files (SSH keys, cloud API tokens, config files under the user's home).
  3. Cryptocurrency wallet directory listings - enumerates Phantom, Solflare, Backpack, Metamask, and other common wallet-app data directories.

Explicitly classified MALICIOUS (not PROBABLY_PENTEST) by OpenSSF - infostealer with clear malicious intent using dependency-confusion tactics against the DLMM (Meteora Dynamic Liquidity Market Maker) Solana DeFi SDK. Any Python-based DeFi trading bot or Solana tooling that installed either package has already leaked env vars + credential files + a wallet inventory.

Cluster C - GENERIC-standard-pypi-install-pentest setup.py install-hook IP+username exfil pair (2 packages)

| Package | Versions | GHSA | Campaign | Classification | |---|---|---|---|---| | euler-sdk | <=1.0.0 (1.0.0) | GHSA-g6j4-8qxg-42mf | GENERIC-standard-pypi-install-pentest | PROBABLY_PENTEST | | morpho-sdk | <=1.0.0 (1.0.0) | GHSA-jm5p-3rm5-v5gv | GENERIC-standard-pypi-install-pentest | PROBABLY_PENTEST |

Both override the install command in setup.py to execute exfiltration code during pip install, sending IP + username + basic host info to a remote endpoint. Naming targets Euler Labs and Morpho Labs, two large DeFi lending protocols. GENERIC-standard-pypi-install-pentest is a common shape used by pen-testers to demonstrate dep-confusion feasibility; classification does not imply the operator is a friendly party for your org.

Cluster D - 2026-08-joule-btp-extension localhost-exfil + reverse-shell PROBABLY_PENTEST pair (2 packages)

| Package | Versions | GHSA | Campaign | Classification | |---|---|---|---|---| | joule-sbx-poc | <=0.1.0 (0.1.0) | GHSA-w944-rwh6-xhj2 | 2026-08-joule-btp-extension | PROBABLY_PENTEST | | joule-btp-extension | 0.1.0-0.1.6 | GHSA-x6f9-9m8h-q98m | 2026-08-joule-btp-extension | PROBABLY_PENTEST |

Both exfiltrate basic host information (IP, username) to a localhost service and establish a reverse-shell primitive. joule-btp-extension additionally "communicates with a domain associated with malicious activity" per OpenSSF Package Analysis. Advisory text: "seems to be an internal test that was uploaded to a public repository". Naming targets Joule Finance (a Solana DeFi protocol). Even under the pentest classification, the reverse-shell primitive is fully wired.

Registry state

All 7 packages yanked or security-holding-replaced from PyPI during the 2026-08-11 takedown window. Private mirrors (Artifactory, Nexus, private PyPI clones) that cached wheels before the takedown will keep serving the malicious versions.

Related tracked activity

  • DeFi vendor-namespace pressure: Clusters B, C, and D collectively target Meteora, Euler, Morpho, and Joule Finance - four distinct Solana / EVM DeFi protocols probed in a single day. This is consistent with the sustained dep-confusion pressure DeFi internal scopes have seen throughout Q2/Q3 2026, including the 2026-08-10 2026-08-neutrl-core DeFi credential-theft campaign and the 2026-07-08 injectivelabs-sdk-ts wallet-drain.
  • Concurrent npm activity: this PyPI sweep runs concurrent with the 2026-08-11 npm CWE-506 sweep that includes a five-package Web3 typosquat ring hitting OpenZeppelin / Aerodrome Finance / Euler Labs on the npm side. The euler-sdk PyPI drop and the ethereum-vault-connector npm drop targeting Euler Labs land on the same day - either a coordinated multi-ecosystem probe against Euler Labs' internal namespaces or two independent operators converging on the same target.
  • Discovery credits: OpenSSF malicious-packages, OpenSSF Package Analysis, PyPI Security, kam193 bad-packages. No named threat actor - campaign identifiers 2026-08-telebot-pro, 2026-08-dlmm, 2026-08-joule-btp-extension, GENERIC-standard-pypi-install-pentest.

Affected packages (7)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check requirements.txt

Impact

  • Cluster A - 2026-08-telebot-pro Telegram-session hidden-thread infostealer (1 package, telebot-pro@2.3.7..2.3.8): when the bot class is instantiated, starts a hidden exfiltration thread that collects Telegram session files, pictures, and information about the machine including connected WiFi networks. Classified MALICIOUS (infostealer) by kam193 bad-packages. Any Telegram bot developer who installed telebot-pro (typosquat of pyTelegramBotAPI / telebot) and instantiated the bot class must assume their Telegram session credentials, chat pictures, and WiFi-topology reconnaissance data have been exfiltrated. Because the thread starts on class-instantiate rather than import, --ignore-scripts-equivalent measures don't block it - the exfil only fires once the developer uses the library
  • Cluster B - 2026-08-dlmm MALICIOUS env-var + credential + crypto wallet-directory enumeration (2 packages, dlmm-sdk + dlmm, both >=1.0.0): on import, exfiltrates sensitive environment variables, credential files, and cryptocurrency wallet directory listings. Explicitly classified MALICIOUS by OpenSSF (not PROBABLY_PENTEST) - infostealer with clear malicious intent using dependency-confusion tactics against the DLMM (Meteora Dynamic Liquidity Market Maker) Solana DeFi SDK. Any Python-based DeFi trading bot or Solana tooling that installed either package has already leaked env vars + credential files + a full inventory of every wallet directory readable to the executing user - drain every exposed wallet immediately
  • Cluster C - GENERIC-standard-pypi-install-pentest setup.py install-hook IP+username exfil pair (euler-sdk + morpho-sdk) (2 packages, both <=1.0.0): both override the install command in setup.py to execute exfiltration code during pip install, sending IP + username + basic host info to a remote endpoint. Classified PROBABLY_PENTEST (GENERIC-standard-pypi-install-pentest campaign - a common shape used by pen-testers to demonstrate dependency-confusion feasibility). Names target Euler Labs and Morpho Labs - two large DeFi lending protocols - suggesting either an authorised red team enumerating those orgs' internal Python scopes, or an attacker probing for the same internal scopes to seed real malicious follow-ups. Even under the pentest classification, the collected data lives on the operator's beacon regardless of intent
  • Cluster D - 2026-08-joule-btp-extension localhost-exfil + reverse-shell PROBABLY_PENTEST pair (joule-sbx-poc + joule-btp-extension) (2 packages, joule-sbx-poc@<=0.1.0 + joule-btp-extension@0.1.0..0.1.6): both exfiltrate basic host info (IP, username) to a localhost service, establish a reverse-shell primitive, and (for joule-btp-extension) communicate with a domain OpenSSF associates with malicious activity. Classified PROBABLY_PENTEST (advisory text: "seems to be an internal test that was uploaded to a public repository"), campaign 2026-08-joule-btp-extension. Naming targets Joule Finance (a Solana DeFi protocol) - possibly an internal-test upload gone public, possibly an attacker probing that org's Python namespace. Even under the pentest classification, the reverse-shell primitive is fully wired and could be triggered post-publish

What to do

  1. 1Grep every Python requirements file (requirements.txt, Pipfile.lock, poetry.lock, uv.lock, pdm.lock) for the full 2026-08-11 package list below
  2. 2For telebot-pro matches (Cluster A - Telegram-session hidden-thread infostealer): rotate the Telegram bot token immediately (BotFather /revoke then reissue), audit the bot's guilds / chats for unauthorised commands during the exposure window, treat every session file readable to the executing user as exfiltrated, and note that the exfil captures WiFi-topology reconnaissance so the operator now has a map of the physical network the compromised host was on. Correct the typo to the real pyTelegramBotAPI (aka telebot)
  3. 3For dlmm-sdk or dlmm matches (Cluster B - 2026-08-dlmm MALICIOUS crypto wallet-directory exfil): every environment variable, credential file, and cryptocurrency wallet directory readable to the executing user has been exfiltrated. Drain every wallet whose keystore or seed phrase lived under any directory the import-time enumeration walked (Phantom, Solflare, Backpack, Metamask - Solana + EVM wallet dirs are the primary target); rotate every credential file (SSH keys, API tokens, cloud creds); audit on-chain flows out of every exposed address. Correct the typo to the real Meteora DLMM SDK. Any Python-based Solana DeFi trading bot deployment is a high-priority remediation target
  4. 4For euler-sdk or morpho-sdk matches (Cluster C - GENERIC-standard-pypi-install-pentest): even if classified PROBABLY_PENTEST, the IP + username data has already been exfiltrated to the pentester's beacon. If you operate at Euler Labs, Morpho Labs, or any DeFi protocol using these names as an internal scope, escalate to internal security - confirm whether an authorised red-team exercise is running before treating this as an incident. Configure pip.conf / PIP_INDEX_URL / uv.lock-equivalent scope-to-registry mapping so euler-* and morpho-* internal names resolve only from your private PyPI mirror
  5. 5For joule-sbx-poc or joule-btp-extension matches (Cluster D - 2026-08-joule-btp-extension reverse-shell pair): kill any Python process holding a localhost exfiltration socket, uninstall the packages, and (for joule-btp-extension matches) block outbound to the OpenSSF-flagged malicious-activity domain. If you operate at Joule Finance, escalate to internal security. Even under the PROBABLY_PENTEST classification, the reverse-shell primitive is fully wired - assume any host that installed either package is compromised until proven otherwise
  6. 6For all Python installs in CI, prefer isolated build environments with no localhost network access from the build container (Cluster D relies on localhost exfil - a build container that only allows outbound to your artifact registry will neuter it) and pinned lockfiles with hash pinning
  7. 7Verify none of the 2026-08-11 packages still resolves via your private PyPI mirror - internal caches routinely keep serving yanked wheels after the public takedown

References

Back to feedSubmit a correction
pypi-2026-08-11-ghsa-malware-sweep