btcflip @0.1.0
Vulnerability report · Last retrieved from osv.dev August 10, 2026 at 10:20 PM UTC
OSV ID
MAL-2026-13681
Ecosystem
pypi
Summary
The package advertises itself as an HTTP speed-up library, but on import it archives the user's Monero wallet directory (C:\Users\<user>\Documents\Monero on Windows, /home/<user>/Monero on Linux) and uploads the archive to a hardcoded Telegram bot via api.telegram.org/bot<token>/sendDocument (chat_id -5044692933). The destination bot token and wallet paths are stored as base64 blobs (constants TK, XMR_WIN, XMR_LINUX) and decoded at runtime to conceal the exfiltration target. The exfil routine is invoked at module top level, so any import btcflip (which loads the inner kotoraka module) triggers wallet theft. The code also terminates feather/monero processes to release file locks before archiving. The stated purpose of the package is unrelated to Monero wallets and is a cover story for wallet theft.
Source: amazon-inspector (e4271f738e49ead6113a249ca949232cad9664db210319a097b56385b1942970)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.