Malicious code in dlmm-sdk (PyPI)

The dlmm-sdk package on PyPI was found to contain malicious code that executes during package import. The malware performs credential and environment variable exfiltration, collecting sensitive data such as API keys and authentication tokens. Additionally, the package enumerates cryptocurrency wallet directories, indicating targeting of users with digital assets.\n\nThe malicious code was identified as part of the 2026-08-dlmm campaign and credited to OpenSSF's malicious-packages project. The package exhibits clear infostealer characteristics with dependency-confusion tactics, suggesting deliberate targeting of developers in the cryptocurrency/blockchain ecosystem.\n\nUsers who installed dlmm-sdk during the malicious distribution period should assume their environment variables, credential files, and wallet information may have been compromised. Immediate remediation includes package removal, credential rotation, and security audits of affected systems.