{"id":8734,"date":"2025-03-07T10:42:52","date_gmt":"2025-03-07T10:42:52","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/malicious-pypi-package-steals-ethereum-keys\/"},"modified":"2025-03-07T10:42:55","modified_gmt":"2025-03-07T10:42:55","slug":"malicious-pypi-package-steals-ethereum-keys","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/malicious-pypi-package-steals-ethereum-keys\/","title":{"rendered":"Malicious PyPI Package Steals Ethereum Keys"},"content":{"rendered":"\n<\/p>\n
\n

\ue802<\/i>Mar 07, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Malware \/ Blockchain<\/span><\/p>\n<\/div>\n

\n
\n<\/p>\n

<\/a>\n<\/div>\n

Researchers specializing in cybersecurity have identified a malicious package on the Python Package Index (PyPI) that is designed to steal Ethereum private keys by masquerading as popular libraries.<\/p>\n

The package, known as set-utils<\/a>, had been downloaded 1,077 times before it was removed from the official registry. It is no longer available for download.<\/p>\n

According to Socket, a company that specializes in software supply chain security, the package “disguises itself as a simple utility for Python sets, mimicking popular libraries such as python-utils (712M+ downloads) and utils (23.5M+ downloads)”.<\/p>\nexplained<\/a>.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

The primary target of the package appears to be Ethereum developers and organizations that use Python-based blockchain applications, particularly those working with Python-based wallet management libraries such as eth-account.<\/p>\n

\n
\n\"Malicious
\n<\/a>\n<\/div>\n

Besides containing the attacker’s RSA public key for encrypting stolen data and an Ethereum sender account under their control, the library also embeds itself into wallet creation functions such as “from_key()” and “from_mnemonic()” to intercept private keys as they are generated on the compromised machine.<\/p>\n

In a notable twist, the private keys are exfiltrated via blockchain transactions through the Polygon RPC endpoint “rpc-amoy.polygon.technology”, in an attempt to evade traditional detection methods that monitor for suspicious HTTP requests.<\/p>\n

“This means that even if a user successfully creates an Ethereum account, their private key will be stolen and transmitted to the attacker,” according to Socket. “The malicious function runs in a background thread, making it even harder to detect.”<\/p>\n

<\/p>\n

If you found this article interesting, you can follow us on Twitter \uf099<\/i><\/a> and LinkedIn<\/a> to read more exclusive content.<\/div>\n<\/div>\n