New Weaponized PyPI Package Attacking Developers to Steal Source Code

A newly discovered malicious Python package, solana-token, has been weaponized to steal source code and sensitive secrets from developers working on Solana blockchain applications. Uploaded to the Python Package Index (PyPI), the module masqueraded as a legitimate utility for Solana-based projects but harbored code designed to exfiltrate critical data to a remote server. The campaign aligns with a broader trend: 23 malicious crypto-focused supply chain attacks were documented in 2024 alone, per RL’s 2025 Software Supply Chain Security Report. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Developers are urged to audit dependencies, monitor for suspicious network activity, and adopt tools like static code analysis to detect obfuscated threats. As supply chain attacks evolve, proactive defense remains critical to safeguarding sensitive code and infrastructure. By harvesting developers’ unprotected secrets (e.g., API keys, wallet credentials), attackers gain a foothold in cryptocurrency projects, posing risks to both individual developers and decentralized platforms. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. ReversingLabs researchers identified the threat in May 2025, noting its rapid dissemination: the package was downloaded over 600 times before its removal. ReversingLabs analysts highlighted the package’s unique focus on source code exfiltration-a tactic less common in typical infostealer campaigns. Notably, the attackers reused the solana-token name from a 2024 PyPI package removed for similar activity. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. When invoked, this function iterates through the Python execution stack, identifying .py files unrelated to specific libraries (prices.py, importlib).

This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 15 May 2025 06:20:19 +0000

Cyber News related to New Weaponized PyPI Package Attacking Developers to Steal Source Code

DPython's Poisoned Package: Another 'Blank Grabber' Malware in PyPI - Python Package Index is a platform that offers an extensive range of packages to simplify and enhance the development process. Malicious actors regularly upload phishing packages in the platform's repository aimed at delivering malware to steal the ...
1 year ago Imperva.com

New Weaponized PyPI Package Attacking Developers to Steal Source Code - A newly discovered malicious Python package, solana-token, has been weaponized to steal source code and sensitive secrets from developers working on Solana blockchain applications. Uploaded to the Python Package Index (PyPI), the module masqueraded ...
1 month ago Cybersecuritynews.com

Cybercriminals pose as "helpful" Stack Overflow users to push malware - Cybercriminals are abusing Stack Overflow in an interesting approach to spreading malware-answering users' questions by promoting a malicious PyPi package that installs Windows information-stealing malware. Sonatype researcher Ax Sharma discovered ...
1 year ago Bleepingcomputer.com

116 Malicious PyPI Packages Downloaded Over 10,000 Times - A cluster of malicious Python projects has been identified in PyPI, the official Python PyPI package repository, which targets both Windows and Linux systems and often deploys a custom backdoor. In certain instances, the ultimate payload consists of ...
1 year ago Cybersecuritynews.com

Building For a More Secure Future: How Developers Can Prioritize Cybersecurity - At the time, he was breaking new ground, repeating those words to help convince his teams on how crucial developers were going to be to the success of their platform. While the focus may have been initially on enterprise B2B platforms with Microsoft, ...
1 year ago Cyberdefensemagazine.com

PyPi package backdoors Macs using the Sliver pen-testing suite - A new package mimicked the popular 'requests' library on the Python Package Index to target macOS devices with the Sliver C2 adversary framework, used for gaining initial access to corporate networks. Discovered by Phylum, the campaign involves ...
1 year ago Bleepingcomputer.com

Malicious PyPi package hides RAT malware, targets Discord devs since 2022 - The attackers could use the malware to gain unauthorized access to credentials and more (e.g., tokens, keys, and config files), steal data and monitor system activity without being detected, remotely execute code for deploying further ...
1 month ago Bleepingcomputer.com

Mastering Cybersecurity: Developer Training - Discover how to create an effective and engaging training program for your developers. Create a security training program with clearly defined goals to influence your developers to prioritize learning. Developers are likelier to participate and exert ...
1 year ago Feeds.dzone.com Equation

Malicious NPM, PyPI Packages Stealing User Information - Check Point and Phylum are warning of recently identified NPM and PyPI packages designed to steal user information and download additional payloads. Taking advantage of the broad use of open source code in application development, malicious actors ...
2 years ago Securityweek.com

Malicious PyPI packages targeting highly specific MacOS machines - As part of our software package supply chain security efforts, we continuously scan for malware in newly released PyPI and NPM packages. In this post, we describe a particularly interesting cluster of malicious packages that we've identified. In late ...
1 year ago Securitylabs.datadoghq.com

With the Right Support, Developers Can Lead Your Organization to Superior PCI-DSS 4.0 Compliance - The Payment Card Industry Data Security Standard version 4.0 will change almost everything about security for any business or organization that accepts electronic payments, which is a vast majority of them. Make no mistake, this update will be ...
1 year ago Feeds.dzone.com

3 PYPI Packages Caught Spreading Malware - Recent reports have highlighted the malicious spreading of malware via 3 specific Python Package Index (PyPI) packages. These 3 packages were identified and reported by Sonatype, a software supply chain security firm. ...
2 years ago Securityaffairs.com

Dotnet Source Generators in 2024 Part 1: Getting Started - Security Boulevard - While nice, this incurs an execution of any classes marked as a source generator every time something changes in the project (i.e., delete a line of code, add a line of code, make a new file, etc.). As you can imagine, having something running every ...
8 months ago Securityboulevard.com

Part 2: Smart Shift Left - In my previous blog post, we discussed the state of the union for shift left and and how many organizations are not implementing correctly. Recognizing the consequences of a poor shift left model. Many of the high friction points with a poor shift ...
1 year ago Feedpress.me

Attackers Finding Novel Ways to Abuse GitHub: ReversingLabs - Threat actors are finding new ways to take advantage of GitHub in hopes of tricking developers into putting malicious code into their software and sending to users downstream, according to researchers with ReversingLabs. Code repositories like GitHub ...
1 year ago Securityboulevard.com

Malicious Python Package Mimic as Attacking Discord Developers With Malicious Remote Commands - The package specifically targeted developers building or maintaining Discord bots-typically indie developers, automation engineers, or small teams who might install such tools without extensive security scrutiny. Following identification, the ...
1 month ago Cybersecuritynews.com

New PyPI Malware Tricking Developers To Gain Access To Ethereum Wallets - By silently intercepting standard wallet creation methods, the malicious package creates a significant security risk for blockchain developers, DeFi projects, crypto exchanges, and individual users managing Ethereum wallets with Python automation. ...
3 months ago Cybersecuritynews.com

Shift-left Convergence with Generative AI Improves the Programmer's Role - The ongoing 'shift left' movement in software development - where testing and quality control measures are moved earlier in the application lifecycle - is pushing developers into less familiar areas such as security. While intended to deliver more ...
1 year ago Feedpress.me

Open Source Password Managers: Overview, Pros & Cons - There are many proprietary password managers on the market for those who want an out-of-the box solution, and then there are open source password managers for those wanting a more customizable option. In this article, we explain how open source ...
1 year ago Techrepublic.com

Are the Fears About the EU Cyber Resilience Act Justified? - On Wednesday, July 19, the European Parliament voted in favor of a major new legal framework regarding cybersecurity: the Cyber Resilience Act. The act enters murky waters when it comes to open-source software. It typically accounts for 70% to 90% of ...
1 year ago Feeds.dzone.com

Are the Fears about the EU Cyber Resilience Act Justified? - "The draft cyber resilience act approved by the Industry, Research and Energy Committee aims to ensure that products with digital features, e.g. phones or toys, are secure to use, resilient against cyber threats and provide enough information about ...
1 year ago Securityboulevard.com

Threat Actors Weaponizing Open Source Packages to Deliver Malware in Supply Chain Attack - In one campaign linked to North Korean threat actors, Socket.dev researchers discovered a package delivering a loader called “BeaverTail” that stole browser data and cryptocurrency wallet credentials before fetching a more advanced ...
1 month ago Cybersecuritynews.com

PyPI Repository Found Hosting Fake Crypto Wallet Recovery Tools That Steal User Data - A new set of malicious packages has been unearthed in the Python Package Index (PyPI) repository that masqueraded as cryptocurrency wallet recovery and management services, only to siphon sensitive data and facilitate the theft of valuable digital ...
8 months ago Thehackernews.com

Google Adds Gemini Pro API to AI Studio and Vertex AI - Google also announced Duet AI for Developers and Duet AI in Security Operations, but neither uses Gemini yet. Starting Dec. 13, developers can use Google AI Studio and Vertex AI to build applications with the Gemini Pro API, which allows access to ...
1 year ago Techrepublic.com

AI-hallucinated code dependencies become new supply chain risk - Although there are no signs that attackers have started taking advantage of this new type of attack, researchers from open-source cybersecurity company Socket warn that hallucinated package names are common, repeatable, and semantically plausible, ...
2 months ago Bleepingcomputer.com