Malicious code in alphalend-abi (PyPI)

The alphalend-abi package published to PyPI contained intentionally malicious code designed to steal sensitive cryptographic material. Upon import, the package exfiltrates files containing SUI private keys to an attacker-controlled private GitHub repository.\n\nThe malicious behavior persists across Python sessions through abuse of PTH (path) files, ensuring the exfiltration occurs not only during initial package import but also on every subsequent Python startup. This persistence mechanism significantly increases the risk of credential compromise for affected users.\n\nThe malicious package was identified as part of the 2026-08-alphalend-layouts campaign and documented by the OpenSSF malicious packages project. The attack demonstrates clear intent for financial theft, targeting cryptocurrency-related private keys and leveraging obfuscation techniques to evade detection."