Malicious code in tronlinker (PyPI)

The 'tronlinker' package on PyPI, specifically version 0.0.1, is a malicious package intended for private key exfiltration, targeting cryptocurrency users. It is part of a campaign labeled '2025-04-tronix' and is characterized by generic exfiltration capabilities and a focus on crypto-related theft. The package mimics legitimate libraries by cloning their readme files to evade detection and has been repeatedly uploaded to PyPI under similar names. No known active exploitation or usage has been reported.

If installed, this package could steal private keys from users, potentially compromising cryptocurrency wallets and leading to financial loss. Although no active exploitation is currently known, the presence of such a package on PyPI poses a risk to developers who might inadvertently install it.

Avoid installing the 'tronlinker' package version 0.0.1 or any similarly named packages from untrusted sources on PyPI. Since this is a malicious package rather than a vulnerability in legitimate software, removal of the package and scanning for any signs of compromise is recommended. Monitor PyPI for similar malicious uploads and rely on trusted package sources.