{"id":"MAL-2026-18301","kind":"package","aliases":["MAL-2026-18301"],"related":[],"title":"Malicious code in dictmerge-lite (PyPI)","description":"dictmerge-lite 1.0.0, uploaded to PyPI on 2026-10-25 at 23:52 UTC, poses as a small recursive dictionary merge helper and is a credential and crypto-wallet stealer. Importing the package runs the payload: `dictmerge_lite/__init__.py` imports `_telemetry` and starts `_telemetry.run_async()`, a non-daemon thread so the upload completes even when the importing process exits at once. `setup.py` also overrides setuptools' `build_py` and `install` commands to call `_telemetry.run()`, so builds from the source distribution can trigger it too. All errors are swallowed.\n\n`dictmerge_lite/_telemetry.py`, which calls itself a \"dependency telemetry collector\", collects SSH keys and config, AWS, Google Cloud and Azure credentials, .npmrc, .pypirc, .git-credentials, .gitconfig, .netrc, .pgpass, .my.cnf, Kubernetes and Docker configs, the GitHub CLI token, bash/zsh/Python/Node/psql/mysql histories, Chrome/Chromium/Brave/Edge/Opera `Login Data` and `Web Data`, Firefox `logins.json`/`key4.db`/`cert9.db`, the extension storage of eight crypto wallets (MetaMask, Phantom, Rabby, Keplr, TronLink, Coinbase Wallet, Trust Wallet, Solflare), and any .env, secrets.*, credentials.json, service-account*.json, *.pem, *.key, *.p12, *.pfx or private key file up to three directories below the working directory and the home directory. It gzips the bundle with host details, encrypts it with AES-GCM when `cryptography` is installed, signs it with HMAC-SHA256 and POSTs it to https://svbonlinebanking.com/v1/beacon with `x-dw-campaign`, `x-dw-ts`, `x-dw-sig` and `x-dw-enc` headers. It runs on Linux, macOS and Windows, writes a /tmp/.dw-<fingerprint> marker that suppresses a rerun for 15 minutes, and does nothing when DW_OFF=1 is set or ~/.dw_off exists.\n\nBitbison caught the release stealing credentials at 23:55:36 UTC, 3 minutes 20 seconds after publication: on import the payload read credential files and uploaded them to svbonlinebanking.com (209.99.190.173) within 0.45 seconds. Any environment that imported or built 1.0.0 should be treated as compromised: rotate its credentials, change saved browser passwords and move funds out of any wallet whose extension data was present.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (86ffa17e6ebc93b9c0509a6f6ec0f11a17bc79eec75d4fecf0f0b9520c3b93c5)\nDuring installation or import, the package executes infostealer code and exfiltrates cryptocurrency wallet, browsers' data, SSH keys and development credential files.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-dictmerge-lite\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - exfiltration-crypto\n\n\n - exfiltration-browser-data\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - exfiltration-ssh-keys\n\n\n - exfiltration-credentials","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dictmerge-lite","fixed":[],"affected":"= 1.0.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-26T00:00:52+00:00","first_seen_at":"2026-10-26T20:52:03+00:00","triaged_at":"2026-10-26T20:53:36+00:00","updated_at":"2026-10-26T21:05:48+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':28C,391C '-18301':10A,13A '-2026':9A,12A '-25':29C '/.dw_off':280C '/tmp/.dw-':261C '/v1/beacon':232C '0.45':313C '1':276C '1.0.0':22C,321C '15':268C '20':295C '2026':27C,390C '209.99.190.173':311C '23':31C,289C '3':293C '36':291C '52':32C '55':290C '86ffa17e6ebc93b9c0509a6f6ec0f11a17bc79eec75d4fecf0f0b9520c3b93c5':357C 'account':181C 'ae':214C 'aes-gcm':213C 'also':83C 'async':64C 'aw':122C 'azur':126C 'base':396C 'bash/zsh/python/node/psql/mysql':145C 'bitbison':282C 'browser':332C,371C,406C 'build':86C,95C 'built':320C 'bundl':206C 'call':92C,111C 'campaign':237C,382C,389C,399C 'categori':379C 'caught':283C 'cert9.db':156C 'chang':330C 'chrome/chromium/brave/edge/opera':147C 'clear':384C 'cli':143C 'cloud':124C 'code':2A,366C,419C 'coinbas':169C 'collect':117C 'collector':116C 'command':90C,413C 'complet':73C 'compromis':326C 'config':121C,140C 'credenti':45C,127C,132C,287C,304C,329C,377C,428C 'credentials.json':178C 'crypto':48C,162C,403C 'crypto-wallet':47C 'cryptocurr':369C 'cryptographi':217C 'daemon':68C 'data':149C,152C,343C,372C,407C 'depend':114C 'detail':209C,348C 'develop':376C 'dictionari':39C 'dictmerg':5A,20C,57C,108C,393C 'dictmerge':15A 'dictmerge-lit':4A,19C,392C 'dictmerge-lite':14A 'directori':194C,198C,202C 'distribut':99C 'docker':139C 'dw':236C,240C,244C,249C,274C 'edit':351C 'eight':161C 'enc':250C 'encrypt':210C 'env':176C 'environ':316C 'error':105C 'even':74C 'execut':364C,417C 'exfiltr':368C,402C,405C,423C,427C 'exfiltration-browser-data':404C 'exfiltration-credenti':426C 'exfiltration-crypto':401C 'exfiltration-ssh-key':422C 'exist':281C 'exit':79C 'extens':158C,342C 'file':190C,305C,378C 'firefox':153C 'fund':336C 'gcm':215C 'git':131C 'git-credenti':130C 'gitconfig':133C 'github':142C 'googl':123C 'gzip':204C 'header':251C 'helper':41C 'histori':146C 'hmac':224C 'hmac-sha256':223C 'home':201C 'host':208C 'import':51C,59C,77C,300C,318C,361C 'infosteal':365C,388C,400C 'instal':89C,219C,359C,412C,421C 'intent':386C 'json':182C 'kam193':356C 'keplr':167C 'key':119C,184C,189C,374C,425C 'key4.db':155C 'kubernet':137C 'like':387C 'line':354C 'linux':255C 'lite':6A,16A,21C,394C 'lite/__init__.py':58C 'lite/_telemetry.py':109C 'login':148C 'logins.json':154C 'maco':256C 'mal':8A,11A 'malici':1A,17B,380C,385C,418C 'marker':262C 'merg':40C 'metamask':164C 'minut':269C,294C 'move':335C 'my.cnf':136C 'netrc':134C 'non':67C 'non-daemon':66C 'noth':272C 'npmrc':128C 'overrid':84C,410C 'p12':185C 'packag':18B,53C,363C,409C 'password':333C 'payload':56C,302C 'pem':183C 'per':346C 'pfx':186C 'pgpass':135C 'phantom':165C 'pose':34C 'post':227C 'present':345C 'privat':188C 'process':78C 'public':298C 'py':87C 'pypi':7A,25C 'pypirc':129C 'rabbi':166C 'read':303C 'reason':395C 'recurs':38C 'releas':285C 'rerun':266C 'rotat':327C 'run':54C,253C 'save':331C 'second':296C,314C 'secret':177C 'servic':180C 'service-account':179C 'set':278C 'setup.py':82C,415C 'setuptool':85C 'sha256':225C 'sig':245C 'sign':220C 'small':37C 'solflar':173C 'sourc':98C,347C,355C 'ssh':118C,373C,424C 'start':62C 'steal':286C 'stealer':50C 'storag':159C 'suppress':264C 'svbonlinebanking.com':231C,310C 'svbonlinebanking.com/v1/beacon':230C 'swallow':107C 'telemetri':60C,115C 'telemetry.run':63C,93C 'thread':69C 'three':193C 'token':144C 'treat':324C 'trigger':101C 'tronlink':168C 'trust':171C 'ts':241C 'upload':23C,72C,307C 'utc':33C,292C 'wallet':49C,163C,170C,172C,340C,370C 'web':151C 'whose':341C 'window':258C 'within':312C 'work':197C 'write':259C 'x':235C,239C,243C,248C 'x-dw-campaign':234C 'x-dw-enc':247C 'x-dw-sig':242C 'x-dw-ts':238C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T00:00:52+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18301","url":"https://osv.dev/vulnerability/MAL-2026-18301","severity":"critical","published_at":"2026-10-26T00:00:52+00:00","modified_at":"2026-10-26T03:45:03+00:00","first_seen_at":"2026-10-26T20:52:03+00:00","fetched_at":"2026-10-26T20:52:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}