MAL-2025-3436 Malicious code in bitcoinlib-dev (PyPI)
- Package
- bitcoinlib-dev
- Registry
- PyPI
What is MAL-2025-3436?
MAL-2025-3436 is a malicious package in bitcoinlib-dev, published on 30 Mar 2025.
Official description
It overwrites the 'clw' command from legit bitconinlib package and attempts to exfiltrate its database on the usage.
As a context, it appears to be created to lure users seeking for help with the bitconinlib package: https://github.com/1200wd/bitcoinlib/issues/455#issuecomment-2764513104
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-03-bitcoinlibdbfix
Reasons (based on the campaign):
files-exfiltration
crypto-related
action-hidden-in-lib-usage
exfiltration-crypto
What should I do about MAL-2025-3436?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.
Sources
Also known as SNYK-PYTHON-BITCOINLIBDEV-9667327.