GitHub Advisory PyPI CWE-506 sweep - 4-package 2026-08-04 batch (Bitcoin hardware-wallet infostealer cluster `2026-08-coldcard-helpers` + `2026-08-psbt-utils`, plus 1 pentest kit)

What happened

On 2026-08-04, the GitHub Advisory Database published 4 new PyPI CWE-506 (Embedded Malicious Code) advisories across two campaign clusters. Three are Bitcoin hardware-wallet infostealers attributed to sibling OpenSSF campaigns 2026-08-coldcard-helpers and 2026-08-psbt-utils; the fourth is a low-harm pentest recon kit under the generic pentest campaign umbrella.

Cluster A - Bitcoin hardware-wallet infostealer trio (3 packages, 2026-08-04)

| Package | Versions | Campaign | Notes | |---|---|---|---| | coldcard-helpers | <= 1.4.2 | 2026-08-coldcard-helpers | setup.py install override; Telegram exfil of env vars, crypto wallets, SSH keys. Discovery credited to kam193 | | psbt-helpers | 1.0.0 (all versions) | 2026-08-psbt-utils | Masquerades as firmware-upgrade tool; steals crypto wallets, browser credentials, SSH keys, TOTP seeds, clipboard; scheduled-task / LaunchAgent persistence; CI-environment detection | | psbt-utils | all versions | 2026-08-psbt-utils | Peer to psbt-helpers under same campaign designation |

The trio explicitly targets Coldcard users (a Bitcoin-only hardware wallet family with strong OPSEC-conscious userbase) and PSBT (Partially Signed Bitcoin Transaction) workflows. PSBT is the BIP-174 standard for coordinating multi-signature Bitcoin transactions across cold-storage and hot-wallet co-signers; a compromised PSBT-tooling package can substitute output addresses at signing time, exfiltrate the PSBT itself (which leaks the wallet-descriptor and xpub set), or wait dormant until an actual signing session and then substitute a destination address in the unsigned PSBT before it is displayed to the user for confirmation on the hardware wallet screen.

The advisory prose on psbt-helpers specifically calls out CI-environment detection to evade sandboxes, which is a research-grade evasion behaviour uncommon in mass-yield credential stealers. Combined with the specific Coldcard / PSBT targeting, this trio reads as a targeted campaign against Bitcoin developer / power-user workflows rather than a generic crypto-wallet drain campaign.

Cluster B - pentest / low-harm host-recon (1 package, 2026-08-04)

| Package | Versions | Campaign | Notes | |---|---|---|---| | launchdarkly-ai-server-sdk | 1.0.1..1.9.9 | GENERIC-standard-pypi-install-pentest (classified PROBABLY_PENTEST) | setup.py install override; exfiltrates only IP + username |

The payload only exfiltrates IP and username - classified as PROBABLY_PENTEST by the OpenSSF classifier, matching earlier GENERIC-standard-pypi-install-pentest drops. The 9-version range (1.0.1..1.9.9) suggests a red-team tester scripted a systematic re-publish across a legitimate SDK's version series - the legitimate LaunchDarkly Python SDK is launchdarkly-server-sdk (without -ai-), so this looks like a typo-adjacent dep-confusion probe against orgs whose AI/ML teams may have added an -ai- variant in the middle of the name.

Registry state

All 4 packages yanked from PyPI during the 2026-08-04 takedown. Original tarballs no longer resolvable on the public index, but private mirrors (devpi, Artifactory, Nexus, AWS CodeArtifact, Google Artifact Registry) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

Related tracked activity

• The 2026-08-coldcard-helpers and 2026-08-psbt-utils campaign names are sibling OpenSSF designations - watch subsequent daily PyPI GHSA batches for related coldcard-* / psbt-* / bitcoin-* / bip174-* / bip32-* variants under the same campaign umbrella.
• The GENERIC-standard-pypi-install-pentest classification is the same one applied to prior LaunchDarkly-adjacent recon kits and reads across many PyPI daily sweeps - see pypi-2026-07-28-ghsa-malware-sweep, pypi-2026-07-31-ghsa-malware-sweep for context on the pattern.
• No threatActor field is set - the OpenSSF campaign names are campaign designations, not named actors. Discovery credited to security researcher kam193.

Affected packages (4)

Impact

• Any host that installed coldcard-helpers, psbt-helpers, or psbt-utils should treat every cryptocurrency wallet on that host as fully compromised, plus every browser credential, SSH key, TOTP seed, and clipboard capture in the exposure window. The three packages share a Bitcoin-hardware-wallet targeting profile and are attributed to sibling OpenSSF campaigns (2026-08-coldcard-helpers and 2026-08-psbt-utils)
• Cluster A - Bitcoin hardware-wallet infostealer trio (3 packages, 2026-08-04): coldcard-helpers@<=1.4.2 (setup.py install-command override, Telegram exfil of env vars + crypto wallets + SSH keys), psbt-helpers@1.0.0 (masquerades as firmware-upgrade tool; targets browser credentials, SSH keys, TOTP seeds, clipboard, plus wallets; scheduled-task or LaunchAgent persistence; CI-environment detection to evade sandboxes), psbt-utils (peer to psbt-helpers, same campaign designation). The trio explicitly targets Coldcard (Bitcoin-only hardware wallet) users and workflows involving PSBT (Partially Signed Bitcoin Transaction) tooling
• Cluster B - pentest / low-harm host-recon (1 package, 2026-08-04): launchdarkly-ai-server-sdk@1.0.1..1.9.9 classified PROBABLY_PENTEST under GENERIC-standard-pypi-install-pentest - exfiltrates only basic host info (IP + username) via setup.py install-command override. Advisory expressly notes limited harm potential but the version-span implies a research tester enumerated a large range of legitimate LaunchDarkly SDK versions with the same payload
• All 4 packages yanked from PyPI during the 2026-08-04 takedown. Private mirrors (devpi, Artifactory, Nexus, AWS CodeArtifact, Google Artifact Registry) that cached tarballs BEFORE the takedown WILL keep serving the original versions

What to do

1. 1Grep every lockfile (requirements.txt, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda-lock.yml) for coldcard-helpers, psbt-helpers, psbt-utils, launchdarkly-ai-server-sdk. Any match on the first three is a Bitcoin-wallet supply-chain incident: move every hot wallet balance to a fresh seed on an isolated host, re-image the affected machine, rotate SSH keys, browser credentials, TOTP seeds, and every env-var secret the Python process could reach
2. 2Cold storage on a Coldcard or air-gapped hardware wallet is designed to survive PC compromise, but PSBT workflows involve signing transactions where the unsigned PSBT is generated on a host: verify every recent PSBT flow, and treat any unusual outbound-transaction that signed successfully during the exposure window as attacker-mediated
3. 3Audit outbound network from the affected host for Telegram Bot API endpoints (api.telegram.org/bot<TOKEN>/sendMessage) in the install-time window - that is the confirmed coldcard-helpers exfil channel
4. 4For launchdarkly-ai-server-sdk matches: confirm which real package you intended (the legitimate LaunchDarkly Python SDK is launchdarkly-server-sdk - the malicious name inserts -ai-). Rotate any LaunchDarkly SDK keys and revoke API tokens as low-cost precaution even though the payload was pentest-grade
5. 5For all PyPI installs in CI, prefer pip install --require-hashes with a fully-hashed requirements.txt or Poetry / uv / pdm lockfiles that pin resolved hashes - hash-pinning defeats same-name malicious-swap-of-resolved-package attacks
6. 6Verify none of the 4 packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

• GHSA-8vw6-pp4v-8j32 - coldcard-helpers malware advisory (Bitcoin wallet infostealer, Telegram exfil)

  github.com
  GitHub
• GHSA-hxq7-5438-cm4f - psbt-helpers malware advisory (firmware-upgrade masquerade, PSBT / Coldcard targeting)

  github.com
  GitHub
• GHSA-3crg-h67f-c6r9 - psbt-utils malware advisory (2026-08-psbt-utils campaign)

  github.com
  GitHub
• GHSA-8m32-rjxc-vw3m - launchdarkly-ai-server-sdk pentest advisory (host recon)

  github.com
  GitHub
• GitHub Advisory Database - recent PyPI malware advisories

  github.com
  GitHub