The py-base58 package versions 2.1.3 and 2.1.4 on PyPI contain malicious code that, upon import, drops and executes a hidden Linux ELF binary masquerading as a system daemon. This binary acts as a cryptocurrency wallet stealer targeting BIP-39 mnemonics and keystore files for wallets such as Phantom, MetaMask, Ledger, and Exodus. It establishes persistence via a user crontab entry and exfiltrates stolen data encrypted with an embedded RSA public key to multiple public file hosting services. The package also removes its own installation metadata to evade detection by package management tools.