MAL-2026-13683 Malicious code in kotoraka (PyPI)
- Package
- kotoraka
- Registry
- PyPI
What is MAL-2026-13683?
MAL-2026-13683 is a malicious package in kotoraka, published on 10 Aug 2026.
Official description
On import, kotoraka decodes base64-obfuscated filesystem paths pointing at the user's Monero wallet directory (Windows: C:\Users<user>\Documents\Monero; Linux: /home/<user>/Monero), terminates any running feather or monero processes to release file locks, archives the wallet directory into a zip, and uploads it to the Telegram Bot API (api.telegram.org sendDocument) using a hardcoded bot token and chat_id (-5357046713). The Telegram bot token and target paths are stored as base64 literals decoded at runtime. The declared purpose of the package (an HTTP speed-up library) is unrelated to the actual behavior. The exfiltration fires as a top-level side effect of import kotoraka, with no user interaction.
During import, the package exfiltrates cryptocurrency wallet files.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-kotanku
Reasons (based on the campaign):
exfiltration-crypto
uses-telegram-bot
What should I do about MAL-2026-13683?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.