Malicious code in trongridy (PyPI)
Affects trongridySource GCVE Database
Rated by Threat Radar
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPItrongridy | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Avoid installing the 'trongridy' package version 0.0.1 from PyPI. Since this is a malicious package rather than a vulnerability in legitimate software, remediation involves removing any installations of this package and auditing systems for potential compromise.
Description
The PyPI package 'trongridy' version 0.0.1 is identified as malicious software designed for private key exfiltration. It is associated with a campaign targeting cryptocurrency users, specifically related to Tron (TRX). The package may impersonate legitimate libraries by cloning their README files. There are no known exploitations in the wild reported so far.
Impact
If installed, this package could compromise sensitive private keys, leading to theft of cryptocurrency assets. The malicious code's primary impact is the unauthorized exfiltration of private keys, which can result in loss of funds or unauthorized access to cryptocurrency wallets.
Summary
The 'trongridy' package on PyPI, version 0.0.1, is a malicious package intended to exfiltrate private keys, likely targeting cryptocurrency assets related to Tron (TRX). It is part of a broader campaign labeled '2025-04-tronix' with clear malicious intent, categorized as an infostealer. The package mimics legitimate libraries by copying their README content to appear trustworthy. No confirmed active exploitation has been documented.