MalwarePublished 12 Jul 2026

data-harvester (PyPI) · Malicious Code

Affects data-harvesterSource GCVE Database

Malicious package : remove data-harvester and rotate any secrets on hosts that installed it.

Data as of 13 Jul 2026, 09:22 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-10191

What to do

Remove data-harvester from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIdata-harvester	Affected =0.3.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The PyPI package 'data-harvester' version 0.3.1 contains malicious code that, upon import, drops a large base64-encoded Linux ELF executable disguised as a system utility. This executable is saved with open permissions in a hidden directory and a cron job is installed to run it every 12 hours, ensuring persistence. The malicious binary steals cryptocurrency wallet data, encrypts it using embedded RSA code, and exfiltrates it to file-sharing services or IPFS. The package also removes its own metadata and cache directories to erase evidence while maintaining the persistence mechanisms.

Impact

The malicious package compromises systems by installing a persistent backdoor that periodically executes a cryptocurrency wallet stealer. This can lead to theft of sensitive crypto wallet data, resulting in financial loss for affected users. The removal of package metadata and cache directories complicates detection and forensic analysis. There is no indication of exploitation in the wild yet, but the potential impact on users who install this package is significant.

Defensive guidance

The package should be considered untrusted and immediately removed from any environment where it is installed. Users should avoid installing or importing 'data-harvester' version 0.3.1 from PyPI. Review and remove any cron jobs or dropped binaries associated with this package. Monitor for any unauthorized persistence mechanisms. Since this is a malicious package, remediation involves removal and prevention of installation rather than patching.

Summary

The 'data-harvester' PyPI package version 0.3.1 is a malicious package that embeds a ~486KB Linux ELF binary within its __init__.py file. Upon first import, it decodes and writes this binary to a hidden location (~/.config/.npm-cache/snapd-network) with mode 0777, then installs a user cron job to execute the binary every 12 hours. The binary masquerades as a system service but does not correspond to any legitimate npm or snapd path. The malicious payload steals cryptocurrency wallet data, encrypts it with embedded RSA, and exfiltrates the data to external file-sharing services or IPFS. The package also deletes its own dist-info, egg-info, and __pycache__ directories to hinder detection. This behavior is confirmed by multiple sources and is categorized as a malicious campaign targeting crypto assets with persistence and exfiltration capabilities.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Jul 2026, 09:22 UTC

Technical details

References

Community reviews