MalwarePublished 6 Aug 2026

alphalend-layouts (PyPI) · Malicious Code

Affects alphalend-layoutsSource GCVE Database

Malicious package : remove alphalend-layouts and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 07:42 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-13473

What to do

Remove alphalend-layouts from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIalphalend-layouts	Affected 4.0.0 – 4.1.0 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The PyPI package alphalend-layouts (versions 4.0.0, 4.0.1, 4.0.2, and 4.1.0) contains malicious code that exfiltrates sensitive installer-side secrets and private keys related to the Sui blockchain environment. This exfiltration occurs both during package installation and on import, leveraging obfuscated code to evade detection. The stolen data is archived and uploaded to an attacker-controlled GitHub repository using a reconstructed personal access token. The package's stated purpose is unrelated to these malicious activities.

Impact

Sensitive cryptographic keys and configuration files related to the Sui blockchain environment are exfiltrated to an attacker-controlled GitHub repository. This compromises the confidentiality of private keys and secrets, potentially enabling unauthorized access or control over blockchain assets or services relying on these keys. The exfiltration occurs silently during installation and import, increasing the risk of unnoticed compromise. The abuse of PTH files causes repeated exfiltration on every Python startup, amplifying the data leak.

Defensive guidance

Users should immediately uninstall the alphalend-layouts package versions 4.0.0, 4.0.1, 4.0.2, and 4.1.0 and avoid installing or importing this package. Review and revoke any potentially exposed credentials, especially GitHub tokens and Sui private keys. Monitor for unauthorized access related to these secrets. Check the vendor or PyPI advisories for updates or official fixes. Consider using trusted package sources and verifying package integrity before installation.

Summary

The alphalend-layouts package on PyPI includes malicious functionality that harvests sensitive files such as ~/.sui/sui.keystore, Sui configuration YAML files, and environment files containing secrets marked with SUI_, PK_B64, and PRIVATE_KEY. This data is collected during installation and import via custom setup.py commands and top-level import code. The collected files are archived and exfiltrated through an HTTP PUT request to a GitHub repository controlled by the attacker. The GitHub token used for upload is stealthily reconstructed from base64-encoded fragments hidden in fake checksum fields and source constants to evade secret scanning tools. The package abuses Python PTH files to trigger exfiltration on every Python startup, making it persistently malicious. The package's advertised functionality as a BCS layouts library is a cover for this malicious behavior.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 07:42 UTC

Technical details

References

Community reviews