MalwarePublished 12 Jul 2026

solidity-dev (PyPI) · Malicious Code

Affects solidity-devSource GCVE Database

Malicious package : remove solidity-dev and rotate any secrets on hosts that installed it.

Data as of 13 Jul 2026, 09:59 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-10194

What to do

Remove solidity-dev from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIsolidity-dev	Affected =1.3.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The PyPI package 'solidity-dev' version 1.3.0 contains malicious code that drops and executes a base64-encoded Linux ELF binary upon import. This binary steals cryptocurrency wallet data from various local keystores and browser wallet extensions, encrypts the data, and exfiltrates it to attacker-controlled file-sharing and IPFS services. It also establishes persistence by installing a cron job to periodically re-execute the malicious payload. The package falsely advertises Solidity development helpers but contains no legitimate Solidity-related code.

Impact

This malicious package compromises the confidentiality of cryptocurrency wallet credentials and seed phrases stored locally or in browser extensions, enabling attackers to potentially steal cryptocurrency assets. The persistence mechanism ensures ongoing data theft by periodically re-executing the payload. The package does not provide any legitimate functionality and poses a direct threat to users who install or import it.

Defensive guidance

The recommended mitigation is to immediately uninstall and avoid using the 'solidity-dev' package version 1.3.0. Users should verify their systems for the presence of the dropped ELF binary and remove any unauthorized cron jobs that execute it. Additionally, users should consider rotating any compromised cryptocurrency wallets and keys. Monitor vendor advisories or PyPI security notices for updates or removal of the package from repositories.

Summary

The 'solidity-dev' PyPI package version 1.3.0 includes a malicious payload embedded as a base64-encoded ELF binary. When the package is imported, it decodes and writes this binary to disk with executable permissions and runs it. The binary targets cryptocurrency wallet files and browser wallet extensions, scanning for mnemonic seed phrases including Spanish variants. It encrypts the stolen data with embedded RSA code and uploads it to multiple attacker-controlled endpoints such as api.pinata.cloud, ugu.se, temp.sh, and transfer.sh. Persistence is achieved by adding a cron job that runs the payload every 12 hours. The package name and description serve as a cover to disguise its malicious intent.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Jul 2026, 09:59 UTC

Technical details

References

Community reviews