# GitHub Advisory PyPI CWE-506 sweep - 2026-08-11 batch (`joule-sbx-poc`+`joule-btp-extension` 2026-08-joule-btp-extension localhost-exfil + reverse-shell PROBABLY_PENTEST pair, `telebot-pro` 2026-08-telebot-pro Telegram-session hidden-thread infostealer, `euler-sdk`+`morpho-sdk` GENERIC-standard-pypi-install-pentest setup.py install-hook IP+username exfil, `dlmm-sdk`+`dlmm` 2026-08-dlmm MALICIOUS env-var + credential + crypto wallet-directory enumeration)

> 7 PyPI CWE-506 advisories published 2026-08-11 across four named campaigns: **2026-08-telebot-pro** starts a hidden exfiltration thread that lifts **Telegram session files, pictures, and connected WiFi network info**; **2026-08-dlmm** exfiltrates env vars + credentials + cryptocurrency wallet directory listings on import; **2026-08-joule-btp-extension** + `euler-sdk`/`morpho-sdk` are PROBABLY_PENTEST setup.py install-hook recon packages targeting DeFi vendor namespaces.

- Published: 2026-08-11
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: PyPI
- Scope: 7 packages, 14 compromised versions
- Tags: credential-theft, infostealer, crypto-wallet-drain, dependency-confusion
- Also known as: 2026-08-11 GHSA PyPI batch, 2026-08-telebot-pro, 2026-08-dlmm, 2026-08-joule-btp-extension, GENERIC-standard-pypi-install-pentest euler+morpho
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, PyPI Security, kam193 bad-packages
- Incident ID: pypi-2026-08-11-ghsa-malware-sweep

## Affected packages (7)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [dlmm](https://dependencywatch.io/package/pypi/dlmm) | PyPI | 1.0.0 |
| [dlmm-sdk](https://dependencywatch.io/package/pypi/dlmm-sdk) | PyPI | 1.0.0 |
| [euler-sdk](https://dependencywatch.io/package/pypi/euler-sdk) | PyPI | 1.0.0 |
| [joule-btp-extension](https://dependencywatch.io/package/pypi/joule-btp-extension) | PyPI | 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6 |
| [joule-sbx-poc](https://dependencywatch.io/package/pypi/joule-sbx-poc) | PyPI | 0.1.0 |
| [morpho-sdk](https://dependencywatch.io/package/pypi/morpho-sdk) | PyPI | 1.0.0 |
| [telebot-pro](https://dependencywatch.io/package/pypi/telebot-pro) | PyPI | 2.3.7, 2.3.8 |

## What happened

On 2026-08-11, the GitHub Advisory Database published **7 new PyPI CWE-506 (Embedded Malicious Code) advisories** across four distinct named campaigns. The batch is smaller than the same-day npm sweep but tightly focused: three of the four campaigns target **DeFi vendor namespaces** (Meteora DLMM, Euler Labs, Morpho Labs, Joule Finance), plus a Telegram-tooling infostealer.

## Cluster A - 2026-08-telebot-pro Telegram-session hidden-thread infostealer (1 package)

| Package | Versions | GHSA | Campaign | Classification |
|---|---|---|---|---|
| `telebot-pro` | `2.3.7`, `2.3.8` | GHSA-x78w-5mq6-pmpg | 2026-08-telebot-pro | MALICIOUS (infostealer) |

Advisory text: **"when the bot class is used, the code starts a hidden exfiltration thread that collects Telegram session files, pictures and information about the machine, like connected WiFi networks"**. Classified MALICIOUS by kam193 bad-packages, campaign identifier `2026-08-telebot-pro`. Typosquats `pyTelegramBotAPI` (widely imported as `telebot`).

Because the exfiltration thread starts on **class instantiate**, not on import, `--ignore-scripts`-style measures at install time do not block it - the exfil only fires once the developer actually uses the library.

## Cluster B - 2026-08-dlmm MALICIOUS env-var + credential + crypto wallet-directory enumeration (2 packages)

| Package | Versions | GHSA | Campaign | Classification |
|---|---|---|---|---|
| `dlmm-sdk` | `>=1.0.0` (`1.0.0`) | GHSA-jp82-pmg9-xvj9 | 2026-08-dlmm | MALICIOUS |
| `dlmm` | `>=1.0.0` (`1.0.0`) | GHSA-5gh8-34vp-xw63 | 2026-08-dlmm | MALICIOUS |

On import, exfiltrates:

1. Sensitive **environment variables** matching credential patterns.
2. **Credential files** (SSH keys, cloud API tokens, config files under the user's home).
3. **Cryptocurrency wallet directory listings** - enumerates Phantom, Solflare, Backpack, Metamask, and other common wallet-app data directories.

Explicitly classified MALICIOUS (not PROBABLY_PENTEST) by OpenSSF - infostealer with clear malicious intent using dependency-confusion tactics against the **DLMM (Meteora Dynamic Liquidity Market Maker) Solana DeFi SDK**. Any Python-based DeFi trading bot or Solana tooling that installed either package has already leaked env vars + credential files + a wallet inventory.

## Cluster C - GENERIC-standard-pypi-install-pentest setup.py install-hook IP+username exfil pair (2 packages)

| Package | Versions | GHSA | Campaign | Classification |
|---|---|---|---|---|
| `euler-sdk` | `<=1.0.0` (`1.0.0`) | GHSA-g6j4-8qxg-42mf | GENERIC-standard-pypi-install-pentest | PROBABLY_PENTEST |
| `morpho-sdk` | `<=1.0.0` (`1.0.0`) | GHSA-jm5p-3rm5-v5gv | GENERIC-standard-pypi-install-pentest | PROBABLY_PENTEST |

Both **override the install command in `setup.py`** to execute exfiltration code during `pip install`, sending IP + username + basic host info to a remote endpoint. Naming targets Euler Labs and Morpho Labs, two large DeFi lending protocols. `GENERIC-standard-pypi-install-pentest` is a common shape used by pen-testers to demonstrate dep-confusion feasibility; classification does not imply the operator is a friendly party for your org.

## Cluster D - 2026-08-joule-btp-extension localhost-exfil + reverse-shell PROBABLY_PENTEST pair (2 packages)

| Package | Versions | GHSA | Campaign | Classification |
|---|---|---|---|---|
| `joule-sbx-poc` | `<=0.1.0` (`0.1.0`) | GHSA-w944-rwh6-xhj2 | 2026-08-joule-btp-extension | PROBABLY_PENTEST |
| `joule-btp-extension` | `0.1.0`-`0.1.6` | GHSA-x6f9-9m8h-q98m | 2026-08-joule-btp-extension | PROBABLY_PENTEST |

Both **exfiltrate basic host information** (IP, username) **to a localhost service** and establish a **reverse-shell primitive**. `joule-btp-extension` additionally "communicates with a domain associated with malicious activity" per OpenSSF Package Analysis. Advisory text: "seems to be an internal test that was uploaded to a public repository". Naming targets **Joule Finance** (a Solana DeFi protocol). Even under the pentest classification, the reverse-shell primitive is fully wired.

## Registry state

All 7 packages yanked or security-holding-replaced from PyPI during the 2026-08-11 takedown window. Private mirrors (Artifactory, Nexus, private PyPI clones) that cached wheels before the takedown will keep serving the malicious versions.

## Related tracked activity

- **DeFi vendor-namespace pressure**: Clusters B, C, and D collectively target Meteora, Euler, Morpho, and Joule Finance - four distinct Solana / EVM DeFi protocols probed in a single day. This is consistent with the sustained dep-confusion pressure DeFi internal scopes have seen throughout Q2/Q3 2026, including the [2026-08-10 `2026-08-neutrl-core` DeFi credential-theft campaign](https://dependencywatch.io/incident/pypi-2026-08-10-ghsa-malware-sweep) and the [2026-07-08 `injectivelabs-sdk-ts` wallet-drain](https://dependencywatch.io/incident/npm-2026-07-08-injectivelabs-sdk-ts-crypto-wallet-drain).
- **Concurrent npm activity**: this PyPI sweep runs concurrent with the [2026-08-11 npm CWE-506 sweep](https://dependencywatch.io/incident/npm-2026-08-11-ghsa-malware-sweep) that includes a five-package Web3 typosquat ring hitting OpenZeppelin / Aerodrome Finance / Euler Labs on the npm side. **The `euler-sdk` PyPI drop and the `ethereum-vault-connector` npm drop targeting Euler Labs land on the same day** - either a coordinated multi-ecosystem probe against Euler Labs' internal namespaces or two independent operators converging on the same target.
- Discovery credits: `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `PyPI Security`, `kam193 bad-packages`. No named threat actor - campaign identifiers `2026-08-telebot-pro`, `2026-08-dlmm`, `2026-08-joule-btp-extension`, `GENERIC-standard-pypi-install-pentest`.

## Impact

- **Cluster A - 2026-08-telebot-pro Telegram-session hidden-thread infostealer** (1 package, `telebot-pro@2.3.7..2.3.8`): when the bot class is instantiated, **starts a hidden exfiltration thread that collects Telegram session files, pictures, and information about the machine including connected WiFi networks**. Classified MALICIOUS (infostealer) by kam193 bad-packages. Any Telegram bot developer who installed `telebot-pro` (typosquat of `pyTelegramBotAPI` / `telebot`) and instantiated the bot class must assume their Telegram session credentials, chat pictures, and WiFi-topology reconnaissance data have been exfiltrated. Because the thread starts on class-instantiate rather than import, `--ignore-scripts`-equivalent measures don't block it - the exfil only fires once the developer uses the library
- **Cluster B - 2026-08-dlmm MALICIOUS env-var + credential + crypto wallet-directory enumeration** (2 packages, `dlmm-sdk` + `dlmm`, both `>=1.0.0`): on import, exfiltrates **sensitive environment variables, credential files, and cryptocurrency wallet directory listings**. Explicitly classified MALICIOUS by OpenSSF (not PROBABLY_PENTEST) - infostealer with clear malicious intent using dependency-confusion tactics against the **DLMM (Meteora Dynamic Liquidity Market Maker) Solana DeFi SDK**. Any Python-based DeFi trading bot or Solana tooling that installed either package has already leaked env vars + credential files + a full inventory of every wallet directory readable to the executing user - drain every exposed wallet immediately
- **Cluster C - GENERIC-standard-pypi-install-pentest setup.py install-hook IP+username exfil pair (`euler-sdk` + `morpho-sdk`)** (2 packages, both `<=1.0.0`): both **override the install command in `setup.py` to execute exfiltration code during pip install**, sending IP + username + basic host info to a remote endpoint. Classified PROBABLY_PENTEST (`GENERIC-standard-pypi-install-pentest` campaign - a common shape used by pen-testers to demonstrate dependency-confusion feasibility). Names target **Euler Labs and Morpho Labs** - two large DeFi lending protocols - suggesting either an authorised red team enumerating those orgs' internal Python scopes, or an attacker probing for the same internal scopes to seed real malicious follow-ups. Even under the pentest classification, the collected data lives on the operator's beacon regardless of intent
- **Cluster D - 2026-08-joule-btp-extension localhost-exfil + reverse-shell PROBABLY_PENTEST pair (`joule-sbx-poc` + `joule-btp-extension`)** (2 packages, `joule-sbx-poc@<=0.1.0` + `joule-btp-extension@0.1.0..0.1.6`): both **exfiltrate basic host info** (IP, username) **to a localhost service, establish a reverse-shell primitive, and (for `joule-btp-extension`) communicate with a domain OpenSSF associates with malicious activity**. Classified PROBABLY_PENTEST (advisory text: "seems to be an internal test that was uploaded to a public repository"), campaign `2026-08-joule-btp-extension`. Naming targets **Joule Finance** (a Solana DeFi protocol) - possibly an internal-test upload gone public, possibly an attacker probing that org's Python namespace. Even under the pentest classification, the reverse-shell primitive is fully wired and could be triggered post-publish

## What to do

1. Grep every Python requirements file (`requirements.txt`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`) for the full 2026-08-11 package list below
2. **For `telebot-pro` matches (Cluster A - Telegram-session hidden-thread infostealer)**: **rotate the Telegram bot token immediately** (BotFather `/revoke` then reissue), audit the bot's guilds / chats for unauthorised commands during the exposure window, treat every session file readable to the executing user as exfiltrated, and note that the exfil captures **WiFi-topology reconnaissance** so the operator now has a map of the physical network the compromised host was on. Correct the typo to the real `pyTelegramBotAPI` (aka `telebot`)
3. **For `dlmm-sdk` or `dlmm` matches (Cluster B - 2026-08-dlmm MALICIOUS crypto wallet-directory exfil)**: every environment variable, credential file, and cryptocurrency wallet directory readable to the executing user has been exfiltrated. **Drain every wallet whose keystore or seed phrase lived under any directory the import-time enumeration walked** (Phantom, Solflare, Backpack, Metamask - Solana + EVM wallet dirs are the primary target); rotate every credential file (SSH keys, API tokens, cloud creds); audit on-chain flows out of every exposed address. Correct the typo to the real Meteora DLMM SDK. Any Python-based Solana DeFi trading bot deployment is a high-priority remediation target
4. **For `euler-sdk` or `morpho-sdk` matches (Cluster C - GENERIC-standard-pypi-install-pentest)**: even if classified PROBABLY_PENTEST, the IP + username data has already been exfiltrated to the pentester's beacon. **If you operate at Euler Labs, Morpho Labs, or any DeFi protocol using these names as an internal scope, escalate to internal security** - confirm whether an authorised red-team exercise is running before treating this as an incident. Configure `pip.conf` / `PIP_INDEX_URL` / `uv.lock`-equivalent scope-to-registry mapping so `euler-*` and `morpho-*` internal names resolve **only from your private PyPI mirror**
5. **For `joule-sbx-poc` or `joule-btp-extension` matches (Cluster D - 2026-08-joule-btp-extension reverse-shell pair)**: kill any Python process holding a localhost exfiltration socket, uninstall the packages, and (for `joule-btp-extension` matches) block outbound to the OpenSSF-flagged malicious-activity domain. If you operate at Joule Finance, escalate to internal security. Even under the PROBABLY_PENTEST classification, the reverse-shell primitive is fully wired - assume any host that installed either package is compromised until proven otherwise
6. For all Python installs in CI, prefer isolated build environments with **no localhost network access from the build container** (Cluster D relies on localhost exfil - a build container that only allows outbound to your artifact registry will neuter it) and pinned lockfiles with hash pinning
7. Verify none of the 2026-08-11 packages still resolves via your private PyPI mirror - internal caches routinely keep serving yanked wheels after the public takedown

## Check your own dependencies

- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-x78w-5mq6-pmpg - telebot-pro (2026-08-telebot-pro Telegram-session hidden-thread infostealer)](https://github.com/advisories/GHSA-x78w-5mq6-pmpg) - GitHub
- [GHSA-jp82-pmg9-xvj9 - dlmm-sdk (2026-08-dlmm MALICIOUS crypto wallet-directory enumeration)](https://github.com/advisories/GHSA-jp82-pmg9-xvj9) - GitHub
- [GHSA-5gh8-34vp-xw63 - dlmm (2026-08-dlmm MALICIOUS sibling of dlmm-sdk)](https://github.com/advisories/GHSA-5gh8-34vp-xw63) - GitHub
- [GHSA-g6j4-8qxg-42mf - euler-sdk (GENERIC-standard-pypi-install-pentest setup.py install-hook)](https://github.com/advisories/GHSA-g6j4-8qxg-42mf) - GitHub
- [GHSA-jm5p-3rm5-v5gv - morpho-sdk (GENERIC-standard-pypi-install-pentest setup.py install-hook, Morpho Labs)](https://github.com/advisories/GHSA-jm5p-3rm5-v5gv) - GitHub
- [GHSA-w944-rwh6-xhj2 - joule-sbx-poc (2026-08-joule-btp-extension localhost exfil + reverse-shell)](https://github.com/advisories/GHSA-w944-rwh6-xhj2) - GitHub
- [GHSA-x6f9-9m8h-q98m - joule-btp-extension (2026-08-joule-btp-extension, communicates with malicious domain)](https://github.com/advisories/GHSA-x6f9-9m8h-q98m) - GitHub
- [GitHub Advisory Database - recent PyPI malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub

---

Canonical page: https://dependencywatch.io/incident/pypi-2026-08-11-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/pypi-2026-08-11-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).