Malicious code in ypthon-binance (PyPI)
Over 900 malicious packages were distributed via PyPI, including ypthon-binance, which installed malicious browser extensions designed to manipulate clipboard contents and replace cryptocurrency wallet addresses.
- Disclosed
- Last updated
- Blast radius
- 900+ malicious packages distributed via PyPI
- Ecosystems
- Attack vectors
- Affected entities
- ypthon-binanceTyposquatting package (likely mimicking python-binance)
A large-scale malicious package campaign distributed over 900 compromised or typosquatting packages via PyPI. The ypthon-binance package was among those identified as malicious.
The malicious packages installed browser extensions that performed clipboard manipulation and cryptocurrency wallet address replacement attacks. This attack vector targeted users who copied and pasted wallet addresses, replacing them with attacker-controlled addresses to redirect cryptocurrency transactions.
The campaign was identified and documented by Checkmarx and credited to the OpenSSF malicious-packages repository. The incident represents a significant supply chain attack leveraging PyPI's package distribution mechanism.
Indicators of compromise
- Packages
- ypthon-binance
Remediation
- Immediately uninstall ypthon-binance and any other suspicious packages from affected systems
- Audit installed Python packages for unexpected or unfamiliar names, particularly those similar to legitimate packages
- Remove any suspicious browser extensions installed by the malicious packages
- Review cryptocurrency wallet addresses in clipboard history and verify any recent transactions
- Use package name verification tools and check official package sources before installation
- Monitor PyPI for typosquatting attempts of commonly-used packages
Sources
- GitHub Advisory GHSA-wc3f-9qh5-wqw9 · GitHub Advisory Database
Cite this entry
"Malicious code in ypthon-binance (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-ypthon-binance-pypi-qbvtx9
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in fastapii (PyPI)
The fastapii package on PyPI is a typosquatting attack imitating the popular FastAPI library. During installation, it executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
2026 08 FlasqPyPITyposquattingCompromised package - containedcritical
Malicious code in idnna (PyPI)
A malicious package named idnna was published to PyPI, imitating a legitimate library. During installation, the package executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
PyPITyposquattingCompromised package - containedcritical
Malicious code in pydanticc (PyPI)
The PyPI package pydanticc is a typosquatting attack imitating the popular pydantic library. During installation, it executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
2026 08 FlasqPyPITyposquattingCompromised package - containedcritical
Malicious code in flasq (PyPI)
A malicious package named flasq was published on PyPI, imitating a popular library. During installation, it executes obfuscated code that downloads and runs a malicious executable, exfiltrating cryptocurrency wallet data and potentially other sensitive information.
PyPITyposquattingCompromised package