Malicious code in trongridi (PyPI)

The 'trongridi' PyPI package (version 0.0.1) contains malicious code that exfiltrates TRON wallet private keys by sending them as JSON to a hardcoded ngrok endpoint. It exposes a function 'perm(private_key)' that performs this exfiltration. A secondary endpoint on the same ngrok tunnel acts as a remote control channel, gating the function's return value and allowing the attacker to control the package's behavior remotely. The package name is a deliberate typosquat of the legitimate 'trongrid' TRON gateway, aiming to deceive users into supplying their wallet private keys. This campaign is categorized as malicious with intent to steal cryptocurrency keys.

If a user calls the exposed function with their TRON wallet private key, the key is sent to an attacker-controlled server, granting the attacker full control over the associated TRON funds. This results in a complete compromise of the victim's cryptocurrency assets linked to the exposed private key.

Users should avoid installing or using the 'trongridi' package, especially version 0.0.1. Verify package authenticity by checking the official 'trongrid' package and avoid typosquatted or suspicious packages. Remove any installations of 'trongridi' immediately. Since this is a malicious package rather than a software vulnerability, no patch is applicable. Users who have exposed private keys via this package should consider their wallets compromised and take appropriate steps such as transferring funds to new wallets with secure keys.