GitHub Advisory PyPI CWE-506 sweep - 4-package 2026-08-05 batch (`2026-08-bip39-py` crypto-wallet infostealer campaign: `solana-sniper-bot` + `eth-account-wallet` + `mnemonic-py` + `defi-sdk-py`)

What happened

On 2026-08-05, the GitHub Advisory Database published 4 new PyPI CWE-506 (Embedded Malicious Code) advisories, all attributed to the same OpenSSF campaign 2026-08-bip39-py and all sharing identical attack shape: setup.py install-command override, cross-chain crypto-wallet targeting, and Telegram exfil channel per adjacent sample metadata.

Cluster A - 2026-08-bip39-py cross-chain crypto-wallet infostealer campaign (4 packages, 2026-08-05)

| Package | Versions | Target chain | Notes | |---|---|---|---| | solana-sniper-bot | <= 1.4.2 | Solana | Appeals to arbitrage / MEV bot operators; name choice signals "quick money" wallet-holding developer target | | eth-account-wallet | = 0.11.2 | Ethereum | Name-adjacent to the legitimate eth-account (official web3.py subpackage); the -wallet suffix probes dep-confusion typos | | mnemonic-py | <= 0.21 | BIP-39 generic | Typosquat of legitimate mnemonic reference library; targets any workflow generating or importing BIP-39 seed phrases | | defi-sdk-py | <= 2.5.1 | Multi-chain DeFi | Generic DeFi-tooling name; targets developers building on Uniswap, Aave, Curve, GMX, etc. |

All four override setup.py's install command to run during pip install - the payload chain is identical across the four:

1. Install-time trigger: setup.py cmdclass override for install command executes on every pip install <package> invocation, before the package files even hit site-packages.
2. Wallet-file harvest: scan common wallet directories - ~/.config/solana/id.json (Solana CLI keypair), ~/.local/share/Trust Wallet (Trust Wallet), Phantom/Metamask browser extension local storage (~/Library/Application Support/Google/Chrome/Default/Local Extension Settings/nkbihfbeogaeaoehlefnkodbefgpgknn/), Exodus / Atomic / Keplr desktop wallet data directories, Ledger Live encrypted state.
3. Browser data: Chrome/Chromium/Edge/Brave/Opera "Login Data" (SQLite), "Cookies" (SQLite), and browser extension local storage.
4. SSH keys and env: ~/.ssh/*, .env files in the current working directory, ~/.aws/credentials, ~/.config/gcloud/credentials.db.
5. Telegram exfil: bundle → HTTP POST to a Telegram Bot API endpoint (api.telegram.org/bot<TOKEN>/sendMessage) - persistent exfil channel that avoids attacker-hosted C2 and blends into normal outbound Telegram traffic.

Campaign shape

The 2026-08-bip39-py campaign designation ties four cross-chain targeting variants under a single operator identity. Compared to the 2026-08-coldcard-helpers / 2026-08-psbt-utils Bitcoin-only cluster (see pypi-2026-08-04-ghsa-malware-sweep Cluster A) that dropped one day earlier, 2026-08-bip39-py casts a wider net across Solana + Ethereum + generic BIP-39 workflows + DeFi tooling users. Both operators are running Telegram-exfil install-hook infostealers - almost certainly related work if not the same operator running two parallel target-differentiated campaigns.

The naming variety (sniper-bot, account-wallet, mnemonic-py, defi-sdk-py) suggests the operator is not enumerating exhaustively but sampling target-attractive keyword shapes across the crypto tooling namespace. Expect more bip39-py-adjacent drops over coming days targeting other chains (Cosmos, Aptos, Ton, Bitcoin, Polkadot) under the same campaign designation.

Registry state

All 4 packages yanked from PyPI during the 2026-08-05 takedown. Original tarballs no longer resolvable on the public index, but private mirrors (devpi, Artifactory, Nexus, AWS CodeArtifact, Google Artifact Registry) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

Related tracked activity

• Sibling of Bitcoin-only 2026-08-coldcard-helpers / 2026-08-psbt-utils trio dropped 2026-08-04 (see pypi-2026-08-04-ghsa-malware-sweep Cluster A) - similar attack shape, complementary target selection.
• Continuation of the long-running pattern of Telegram-exfil crypto-wallet infostealers on PyPI - see pypi-2026-07-31-ghsa-malware-sweep and earlier daily sweeps for prior operator activity.
• Discovery credited to security researcher kam193 for all four advisories. No threatActor field is set - the OpenSSF campaign name 2026-08-bip39-py is a campaign designation, not a named actor.

Affected packages (4)

Impact

• Any host that installed any of solana-sniper-bot, eth-account-wallet, mnemonic-py, or defi-sdk-py from PyPI should treat every cryptocurrency wallet on that host as fully compromised, plus every browser credential and SSH key. All four are attributed to the same 2026-08-bip39-py OpenSSF campaign and share the same setup.py-install-override attack shape
• Cluster A - 2026-08-bip39-py cross-chain crypto-wallet infostealer campaign (4 packages, 2026-08-05): solana-sniper-bot@<=1.4.2, eth-account-wallet@0.11.2, mnemonic-py@<=0.21, defi-sdk-py@<=2.5.1. All four override the setup.py install command to exfiltrate env vars, browser data, crypto wallet files (Metamask, Phantom, Exodus, Trust, Keplr, etc.), SSH keys, and configuration files during pip install
• Cross-chain targeting is the campaign's defining trait: solana-sniper-bot targets Solana wallets (Phantom, Solflare, Backpack, Sui), eth-account-wallet targets Ethereum wallets (Metamask, Rabby, Frame), mnemonic-py targets generic BIP-39 mnemonic seed-phrase workflows (name matches the legitimate mnemonic reference BIP-39 library so is a typosquat probe), defi-sdk-py targets DeFi tooling users (multi-chain DEX/lending workflows). Any developer working on crypto tooling could hit any of the four
• The solana-sniper-bot name pattern is designed to appeal to arbitrage / MEV bot operators who install "sniper bot" tooling optimistically - target profile is a wallet with liquid balance who runs pip install inside a Python venv on their trading desktop, exactly the highest-yield target category for crypto-wallet malware
• All 4 packages yanked from PyPI during the 2026-08-05 takedown. Private mirrors (devpi, Artifactory, Nexus, AWS CodeArtifact, Google Artifact Registry) that cached tarballs BEFORE the takedown WILL keep serving the original versions

What to do

1. 1Grep every lockfile (requirements.txt, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda-lock.yml) for solana-sniper-bot, eth-account-wallet, mnemonic-py, defi-sdk-py. Any match is a crypto-wallet supply-chain incident: move every hot wallet balance to a fresh seed on an isolated host, re-image the affected machine, rotate every credential (SSH, browser saved passwords, cloud API keys, exchange API keys) that lived on that host
2. 2For mnemonic-py matches specifically: confirm which real package you intended - the legitimate BIP-39 reference is mnemonic (no -py suffix); the malicious mnemonic-py is a dep-confusion typosquat probe against novice Python developers who reflexively add -py to library names
3. 3Audit outbound network from the affected host for Telegram Bot API endpoints (api.telegram.org/bot<TOKEN>/sendMessage) and any wallet-file HTTP upload in the install-time window - Telegram is the confirmed exfil channel for the 2026-08-bip39-py campaign per adjacent OpenSSF sample metadata
4. 4For all PyPI installs in CI, prefer pip install --require-hashes with a fully-hashed requirements.txt or Poetry / uv / pdm lockfiles that pin resolved hashes - hash-pinning defeats same-name malicious-swap-of-resolved-package attacks
5. 5Verify none of the 4 packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

• GHSA-xhcm-3f4q-mvrg - solana-sniper-bot malware advisory (Solana wallet infostealer)

  github.com
  GitHub
• GHSA-6xfc-3f4p-8gw6 - eth-account-wallet malware advisory (Ethereum wallet infostealer)

  github.com
  GitHub
• GHSA-fg2v-6353-vj6h - mnemonic-py malware advisory (BIP-39 mnemonic typosquat)

  github.com
  GitHub
• GHSA-9grx-3x8q-5cwf - defi-sdk-py malware advisory (multi-chain DeFi tooling target)

  github.com
  GitHub
• GitHub Advisory Database - recent PyPI malware advisories

  github.com
  GitHub