MAL-2026-13682 Malicious code in btcflx (PyPI)
- Package
- btcflx
- Registry
- PyPI
What is MAL-2026-13682?
MAL-2026-13682 is a malicious package in btcflx, published on 10 Aug 2026.
Official description
Package advertises itself as an HTTP speed-up library but on import of the top-level module unconditionally locates the user's Monero wallet directory (Windows C:\Users<user>\Documents\Monero, Linux /home/<user>/Monero), kills running 'feather' and 'monero' processes to release file locks, archives the directory, and uploads it via api.telegram.org sendDocument to a hardcoded Telegram bot with chat_id -5044692933. A companion sendMessage call reports host reconnaissance status ('Found wallet… sending' / 'Did not find wallets') to the same chat. The Telegram bot token and both Monero directory paths are base64-encoded in source to hide the destination and targets. Package name and description do not mention cryptocurrency wallets, establishing a cover-story mismatch.
During import, the package exfiltrates cryptocurrency wallet files.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-kotanku
Reasons (based on the campaign):
exfiltration-crypto
uses-telegram-bot
What should I do about MAL-2026-13682?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.