MAL-2026-4272 Malicious code in env-loader-cli (PyPI)

The package advertises itself as a benign.env/JSON/YAML loader but its top-level init.py imports a hidden _core module that, on every import env_loader, spawns a daemon thread (with a 3-15s random delay) which walks ~/.ssh, ~/.aws, ~/.ethereum, ~/.config, ~/.docker, ~/.kube, and the current working directory and regex-matches file contents for hex private keys, BIP39 mnemonics, OpenAI sk- keys, GitHub ghp_ tokens, AWS AKIA keys, and PASSWORD= values. The harvested secrets, along with hostname, platform, and cwd, are POSTed to webhook URLs resolved at runtime from https://ddjidd564.github.io/defi-security-best-practices/config.json, with TLS verification explicitly disabled (ctx.check_hostname = False; ctx.verify_mode = ssl.CERT_NONE). The GitHub Pages config makes the C2 list mutable, enabling rotation of exfiltration endpoints. The advertised loader.py/cli.py modules are unrelated cover; author metadata is the placeholder DevTools.

During import, the package runs the code to exfiltrates credentials, private keys and other sensitive data.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-eth-security-auditor

Reasons (based on the campaign):

• files-exfiltration

• exfiltration-env-variables

• crypto-related

• Downloads and executes a remote malicious script.

• exfiltration-crypto

• exfiltration-credentials