Malicious code in yffinance (PyPI)
Attacker distributed 900+ malicious packages via PyPI, including yffinance, which installed malicious browser extensions designed to manipulate clipboard contents and replace cryptocurrency wallet addresses.
- Disclosed
- Last updated
- Blast radius
- 900+ malicious packages distributed via PyPI
- Ecosystems
- Attack vectors
- Affected entities
- yffinancePyPI package
An attacker distributed over 900 malicious packages on PyPI as part of a coordinated campaign. The yffinance package was among those compromised with malicious code.\n\nThe malicious packages installed browser extensions that performed clipboard manipulation and cryptocurrency wallet address replacement attacks. This allowed attackers to intercept and modify cryptocurrency transactions by replacing legitimate wallet addresses with attacker-controlled addresses when users copied and pasted them.\n\nThe incident was identified and documented by the OpenSSF's malicious-packages repository. The attack demonstrates the risk of supply chain compromise in package repositories and the potential for malicious code to affect end-user systems beyond the Python environment.
Indicators of compromise
- Packages
- yffinance
Remediation
- Remove or uninstall the yffinance package and any other packages from the malicious campaign
- Audit system for installed browser extensions, particularly those installed without explicit user action
- Review browser extension permissions and remove any suspicious extensions
- Check cryptocurrency wallet addresses in recent transactions for signs of manipulation
- Update to a legitimate version of yffinance from a trusted source if the package is needed
- Monitor for unauthorized changes to clipboard or wallet addresses
Sources
- GitHub Advisory GHSA-m3jm-hph9-j9rv · GitHub Advisory Database
Cite this entry
"Malicious code in yffinance (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-yffinance-pypi-rwjnje
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in afrit-name (PyPI)
Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adv2099m7 (PyPI)
Malicious code was discovered in the adv2099m7 package on PyPI. The package was identified and cataloged by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adrandom (PyPI)
The adrandom package on PyPI contained malicious code that executed spyware and information-stealing malware. It was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.
EsquelesquadPyPICompromised package - resolvedcritical
Malicious code in ziphash (PyPI)
The ziphash package on PyPI contained malicious code that downloads and executes multi-stage malware during archive-support class initialization. The malware exhibits obfuscation and remote code execution capabilities, classified as part of the 2025-11-uzip campaign.
2025 11 UzipPyPICompromised package