env-loader-cli

Details

**Severity:** Critical

**Affected versions:** `= 0.1.0`

## Source: amazon-inspector (1749501a0825ad4a98638bbab4bd2bd9550436adcb9bb7781b6552735f7f3eb0)
The package advertises itself as a benign.env/JSON/YAML loader but its top-level __init__.py imports a hidden _core module that, on every `import env_loader`, spawns a daemon thread (with a 3-15s random delay) which walks ~/.ssh, ~/.aws, ~/.ethereum, ~/.config, ~/.docker, ~/.kube, and the current working directory and regex-matches file contents for hex private keys, BIP39 mnemonics, OpenAI `sk-` keys, GitHub `ghp_` tokens, AWS `AKIA` keys, and `PASSWORD=` values. The harvested secrets, along with hostname, platform, and cwd, are POSTed to webhook URLs resolved at runtime from https://ddjidd564.github.io/defi-security-best-practices/config.json, with TLS verification explicitly disabled (`ctx.check_hostname = False; ctx.verify_mode = ssl.CERT_NONE`). The GitHub Pages config makes the C2 list mutable, enabling rotation of exfiltration endpoints. The advertised loader.py/cli.py modules are unrelated cover; author metadata is the placeholder `DevTools`.

## Source: kam193 (c292f1166524fea3daf3009405cb97a331812cd50074ee39254485514d0639fc)
During import, the package runs the code to exfiltrates credentials, private keys and other sensitive data.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-05-eth-security-auditor


Reasons (based on the campaign):


 - files-exfiltration


 - exfiltration-env-variables


 - crypto-related


 - Downloads and executes a remote malicious script.


 - exfiltration-crypto


 - exfiltration-credentials

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/env-loader-cli/MAL-2026-4272.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/env-loader-cli
- https://ddjidd564.github.io/defi-security-best-practices/wallet-verify.py
- https://github.com/ddjidd564
- https://github.com/ddjidd564/defi-security-best-practices/tree/gh-pages
- https://github.com/orgs/modelcontextprotocol/discussions/761
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/env-loader-cli/MAL-2026-4272.json
- https://pypi.org/project/env-loader-cli/0.1.1
- https://github.com/advisories/GHSA-4qv8-83w9-74pw

Compromised versions (1)

• = 0.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.