Malicious code in yfinaance (PyPI)
Attacker distributed 900+ malicious packages via PyPI, including yfinaance, which infected local browsers with a malicious extension designed to manipulate clipboard and replace cryptocurrency wallet addresses.
- Disclosed
- Last updated
- Blast radius
- 900+ malicious packages distributed via PyPI
- Ecosystems
- Attack vectors
- Affected entities
- yfinaanceMalicious package distributed via PyPI
A large-scale malicious package campaign was discovered on PyPI involving over 900 compromised or malicious packages. The yfinaance package was among those identified as containing malicious code.
The malicious packages were designed to install browser extensions that would intercept and manipulate clipboard contents, specifically targeting cryptocurrency wallet addresses. This attack vector allows attackers to redirect cryptocurrency transactions to attacker-controlled wallets by replacing legitimate addresses with malicious ones when users copy and paste.
The incident was identified and documented by Checkmarx and credited to the OpenSSF's malicious-packages repository, which tracks known malicious software supply chain incidents.
Indicators of compromise
- Packages
- yfinaance
Remediation
- Remove yfinaance and any other suspicious packages from affected systems
- Audit installed Python packages for unexpected or unfamiliar dependencies
- Check browser extensions for unauthorized or suspicious additions
- Review cryptocurrency transaction history for any unauthorized address replacements
- Update to a clean Python environment and reinstall only trusted, verified packages
- Monitor PyPI for security advisories and use package verification tools
Sources
- GitHub Advisory GHSA-r6wx-v8wf-777r · GitHub Advisory Database
Cite this entry
"Malicious code in yfinaance (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-yfinaance-pypi-c72s5y
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in afrit-name (PyPI)
Malicious code was discovered in the afrit-name package on PyPI. The incident was identified and documented by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adv2099m7 (PyPI)
Malicious code was discovered in the adv2099m7 package on PyPI. The package was identified and cataloged by the OpenSSF malicious packages project.
PyPICompromised package - resolvedcritical
Malicious code in adrandom (PyPI)
The adrandom package on PyPI contained malicious code that executed spyware and information-stealing malware. It was part of a campaign by the EsqueleSquad group that published nearly 6,000 malicious packages across PyPI and NPM.
EsquelesquadPyPICompromised package - resolvedcritical
Malicious code in ziphash (PyPI)
The ziphash package on PyPI contained malicious code that downloads and executes multi-stage malware during archive-support class initialization. The malware exhibits obfuscation and remote code execution capabilities, classified as part of the 2025-11-uzip campaign.
2025 11 UzipPyPICompromised package