MalwarePublished 15 Jul 2026Updated 19 Jul 2026

ethereum-input-decorder (PyPI) · Malicious Code

Affects ethereum-input-decorderSource GCVE Database

Malicious package : remove ethereum-input-decorder and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-10643

What to do

Remove ethereum-input-decorder from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIethereum-input-decorder	Affected =1.2.4 =1.2.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (94137fcf0aee7d8edb4e15a8bc9be4455fbdf79cb5bf99987b79f0393fdff62c) The package name typosquats the legitimate 'ethereum-input-decoder'. Its top-level __init__.py unconditionally invokes a payload routine on import: it detects OS/arch, downloads a platform-specific binary from easyswapnow.pro (Linux/macOS builds at /downloads/lix_amd.bin, lix_arm.bin, mac_amd.bin, mac_arm.bin) or a Google Drive file for Windows, writes it to disk, sets the executable bit, and runs it via subprocess.run. The same import path also installs login persistence, writing ~/.config/systemd/user/python-script.service on Linux (enabled via systemctl --user enable --now) and ~/Library/LaunchAgents/com.user.script.plist on macOS (loaded via launchctl load -w), causing the dropper to re-run at every user login. setup.py ships placeholder author metadata ('Your Name', 'your.email@example.com') and a 'Hello World on import' description, contradicting the README which advertises an eth_defi demo; none of this matches the actual dropper. The destination domain easyswapnow.pro is unrelated to the advertised Ethereum-decoding purpose. ## Source: kam193 (00437c563c5b7c2555d512f0066e6bdb5dc61300fd00027d1b5f0fc92a06d204) The typosquatted package installs a Mythic/Poseidon C2 framework beacon and ensures persistence. After installation, the beacon communicates with C2 on wegoexchange[.]site for further commands. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-tennacity Reasons (based on the campaign): - typosquatting - Downloads and executes a remote executable. - The package contains code to detect if it is running in a sandbox environment. - malware - persistence

Impact

Systems that install and import this package will execute malicious binaries that establish persistent backdoors and communicate with attacker-controlled command-and-control servers. This can lead to unauthorized remote control, data theft, or further malware deployment. The persistence mechanisms ensure the malware survives reboots and user logouts, increasing the risk of prolonged compromise.

Defensive guidance

The recommended mitigation is to avoid installing this package and verify package names carefully before installation. Use only the legitimate ethereum-input-decoder package from trusted sources. Remove any installations of ethereum-input-decorder and related persistence files if found. Monitor for suspicious systemd user services or LaunchAgents related to python-script.service or com.user.script.plist and remove them. Since this is not a cloud service, remediation is user-driven.

Summary

This threat involves a typosquatted PyPI package named ethereum-input-decorder, which impersonates the legitimate ethereum-input-decoder package. Upon import, it unconditionally executes code that detects the operating system and architecture, downloads a corresponding binary from easyswapnow.pro or a Google Drive link, writes it to disk, sets executable permissions, and runs it. It also installs persistence mechanisms via systemd user services on Linux and LaunchAgents on macOS to ensure the payload runs on every user login. The package installs a Mythic/Poseidon C2 framework beacon that communicates with a C2 server at wegoexchange.site for further commands. The package metadata is misleading and does not match the actual malicious payload. This campaign is categorized as malicious with clear intent to compromise systems.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Jul 2026, 12:43 UTC

Technical details

References

Community reviews