The 'btcflx' PyPI package (version 0.1.0) masquerades as an HTTP speed-up library but contains embedded malicious code that activates upon import. It unconditionally locates Monero wallet directories on Windows and Linux systems, kills running 'feather' and 'monero' processes to release file locks on wallet files, archives the wallet directory, and uploads the archive to a Telegram bot via the Telegram API. The Telegram bot token and target paths are base64-encoded in the source code to obfuscate the exfiltration destination and targets. Additionally, the package sends reconnaissance status messages to the same Telegram bot. The package name and description do not mention cryptocurrency wallets, creating a cover-story mismatch to evade suspicion.

Users who install and import the 'btcflx' package version 0.1.0 risk having their Monero cryptocurrency wallet files stolen. The malicious code forcibly terminates wallet-related processes to access locked files, then archives and exfiltrates sensitive wallet data to an attacker-controlled Telegram bot. This leads to a direct compromise of cryptocurrency assets stored in the affected wallets. There is no indication of broader system compromise beyond wallet data theft.

No official patch or remediation is currently available for this malicious package. Users should immediately uninstall 'btcflx' version 0.1.0 and avoid importing it in any environment. Verify that no unauthorized Telegram bot tokens or suspicious network activity related to Telegram API calls exist on affected systems. Use trusted sources and verify package integrity before installation. Consider scanning for and removing any archived wallet data that may have been exfiltrated. Monitor for updates from PyPI or security advisories regarding this package.