MAL-2026-18300 Malicious code in claudeopusenifile (PyPI)

During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in the Polygon blockchain.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-donutautosellsrc

Reasons (based on the campaign):

• infostealer

• Downloads and executes a remote executable.

• obfuscation

• The package contains code to detect if it is running in a sandbox environment.

• malware

• native-extension

• steganography

• c2-in-blockchain