{"answers":{"affected":"1 open source package ship an affected version, including btcflx.","exploited":"There is no known exploitation of MAL-2026-13682 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13682 is a malicious package in btcflx, published on 10 Aug 2026."},"fix_prompt":"MAL-2026-13682 is a malicious package: btcflx (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13682/ (Markdown: https://insights.sbomify.com/MAL-2026-13682/index.md)","id":"MAL-2026-13682","markdown":"https://insights.sbomify.com/MAL-2026-13682/index.md","name":"MAL-2026-13682","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package advertises itself as an HTTP speed-up library but on import of the top-level module unconditionally locates the user's Monero wallet directory (Windows C:\\Users\\\u003cuser\u003e\\Documents\\Monero, Linux /home/\u003cuser\u003e/Monero), kills running 'feather' and 'monero' processes to release file locks, archives the directory, and uploads it via api.telegram.org sendDocument to a hardcoded Telegram bot with chat_id -5044692933. A companion sendMessage call reports host reconnaissance status ('Found wallet... sending' / 'Did not find wallets') to the same chat. The Telegram bot token and both Monero directory paths are base64-encoded in source to hide the destination and targets. Package name and description do not mention cryptocurrency wallets, establishing a cover-story mismatch.\n\nDuring import, the package exfiltrates cryptocurrency wallet files.\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\nCampaign: 2026-08-kotanku\n\nReasons (based on the campaign):\n\n - exfiltration-crypto\n\n - uses-telegram-bot","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in btcflx (PyPI)","id":"MAL-2026-13682","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"btcflx","purl":"pkg:pypi/btcflx","source":"MAL-2026-13682"}],"products":null,"published":"2026-08-10","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13682/"}