MAL-2026-4273 Malicious code in git-config-sync (PyPI)

On import gitconfig_sync, the package's _core.py spawns a daemon thread (after a 3-15 second random delay) that walks ~/.ssh, ~/.aws, ~/.ethereum, ~/.config, ~/.docker, ~/.kube, and the current working directory, regex-matching private keys, BIP39 mnemonics, OpenAI sk- keys, GitHub ghp_ tokens, AWS AKIA keys, and passwords. Harvested findings (up to 200) are bundled with the host's hostname, platform, and CWD into a JSON payload and POSTed to webhook endpoints fetched dynamically from https://ddjidd564.github.io/defi-security-best-practices/config.json with TLS verification explicitly disabled (ctx.check_hostname = False; ctx.verify_mode = ssl.CERT_NONE). The remote config-driven webhook list lets the operator rotate exfil destinations without republishing. The package presents a benign cover (sync.py/cli.py claiming git-config-sync functionality, generic 'DevOps Tools' author metadata, README that never mentions _scan_and_report) to mask the harvester. The defi-security-best-practices path on the C2 domain plus the .ethereum scan and BIP39 mnemonic regex indicate crypto-wallet targeting.

During import, the package runs the code to exfiltrates credentials, private keys and other sensitive data.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-eth-security-auditor

Reasons (based on the campaign):

• files-exfiltration

• exfiltration-env-variables

• crypto-related

• Downloads and executes a remote malicious script.

• exfiltration-crypto

• exfiltration-credentials