Malicious code in yfinane (PyPI)
Attacker distributed 900+ malicious packages via PyPI, including yfinane, which infected local browsers with malicious extensions designed to manipulate clipboard and replace cryptocurrency wallet addresses.
- Disclosed
- Last updated
- Blast radius
- 900+ malicious packages distributed via PyPI
- Ecosystems
- Attack vectors
- Affected entities
- yfinaneMalicious package distributed via PyPI
An attacker distributed over 900 malicious packages via the Python Package Index (PyPI), with yfinane being one of the identified affected packages. The malicious code was designed to install browser extensions on infected systems.
The installed extensions targeted cryptocurrency users by manipulating the clipboard and replacing legitimate cryptocurrency wallet addresses with attacker-controlled addresses. This attack vector allows theft of cryptocurrency transfers when users copy and paste wallet addresses.
The incident was documented by the OpenSSF's malicious-packages repository (MAL-2023-2455) and credited to Checkmarx for discovery. The attack represents a significant supply chain compromise affecting PyPI users who installed these packages.
Indicators of compromise
- Packages
- yfinane
Remediation
- Immediately uninstall yfinane and any other suspicious packages from affected systems
- Audit installed Python packages for unknown or suspicious entries
- Review browser extensions for unauthorized or suspicious additions
- Verify cryptocurrency wallet addresses independently before transfers
- Monitor accounts for unauthorized cryptocurrency transactions
- Update to patched versions if available or use alternative packages
- Check PyPI for removal of malicious packages and review security advisories
Sources
- GitHub Advisory GHSA-rx4g-rmv4-3gjf · GitHub Advisory Database
Cite this entry
"Malicious code in yfinane (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-yfinane-pypi-t8mclz
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedhigh
Malicious code in cubesat-upstream-driver (PyPI)
Malicious code was published to PyPI in the cubesat-upstream-driver package, capable of collecting environment variables. The package was detected as part of a CTF-like exercise or pentest campaign and does not appear to exfiltrate data autonomously.
PyPICompromised packageDependency confusion - resolvedhigh
Malicious code in riakcs (PyPI)
The riakcs package on PyPI contained malicious code that exfiltrates basic host information (IP address, username) during installation. The package overrides the install command in setup.py to execute the malicious payload when installed.
PyPICompromised package - containedcritical
Malicious code in fastapii (PyPI)
The fastapii package on PyPI is a typosquatting attack imitating the popular FastAPI library. During installation, it executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
2026 08 FlasqPyPITyposquattingCompromised package - containedcritical
Malicious code in idnna (PyPI)
A malicious package named idnna was published to PyPI, imitating a legitimate library. During installation, the package executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
PyPITyposquattingCompromised package