mnemonic-py @0.21
Vulnerability report · Last retrieved from osv.dev August 8, 2026 at 6:15 PM UTC
OSV ID
MAL-2026-13362
Ecosystem
pypi
Summary
During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-bip39-py Reasons (based on the campaign): - crypto-related - The package overrides the install command in setup.py to execute malicious code during installation. - exfiltration-crypto - exfiltration-browser-data - exfiltration-env-variables - exfiltration-ssh-keys - exfiltration-credentials - uses-telegram-bot
Source: kam193 (6599d6208d71e0e809661e86bf5641e6e7b871cd6f01a54abf22215b8a88ef11)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.