{"answers":{"affected":"1 open source package ship an affected version, including btcflip.","exploited":"There is no known exploitation of MAL-2026-13681 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13681 is a malicious package in btcflip, published on 10 Aug 2026."},"fix_prompt":"MAL-2026-13681 is a malicious package: btcflip (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13681/ (Markdown: https://insights.sbomify.com/MAL-2026-13681/index.md)","id":"MAL-2026-13681","markdown":"https://insights.sbomify.com/MAL-2026-13681/index.md","name":"MAL-2026-13681","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package advertises itself as an HTTP speed-up library, but on import it archives the user's Monero wallet directory (C:\\Users\\\u003cuser\u003e\\Documents\\Monero on Windows, /home/\u003cuser\u003e/Monero on Linux) and uploads the archive to a hardcoded Telegram bot via api.telegram.org/bot\u003ctoken\u003e/sendDocument (chat_id -5044692933). The destination bot token and wallet paths are stored as base64 blobs (constants TK, XMR_WIN, XMR_LINUX) and decoded at runtime to conceal the exfiltration target. The exfil routine is invoked at module top level, so any `import btcflip` (which loads the inner `kotoraka` module) triggers wallet theft. The code also terminates feather/monero processes to release file locks before archiving. The stated purpose of the package is unrelated to Monero wallets and is a cover story for wallet theft.\n\nDuring import, the package exfiltrates cryptocurrency wallet files.\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\nCampaign: 2026-08-kotanku\n\nReasons (based on the campaign):\n\n - exfiltration-crypto\n\n - uses-telegram-bot","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in btcflip (PyPI)","id":"MAL-2026-13681","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"btcflip","purl":"pkg:pypi/btcflip","source":"MAL-2026-13681"}],"products":null,"published":"2026-08-10","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13681/"}