python-walletlibr-v

GHSA-pfrw-v3ch-6m8x

Malicious code in python-walletlibr-v (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.7.9`

## Source: amazon-inspector (6783cffec9c8f9377babacd1cb4490a278bace564b34861bf49b35258be7220c)
python-walletlibr-v is a wallet-lookalike PyPI package that ships no wallet functionality — only a stub hello() that prints 'Hello from my custom library!' and placeholder author metadata (__author__ = 'Your Name'). Its setup.py registers a CustomInstall command that, on Windows at pip install time, writes a.bat file into %TEMP%, spawns a new cmd.exe console to execute it via subprocess.Popen(['cmd.exe','/k', bat_path], CREATE_NEW_CONSOLE), and calls os.system('calc'). Arbitrary local command execution fires automatically during pip install on Windows hosts, unrelated to any advertised functionality.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/27544b01e84dd658593ef8e132d2906cf04dd4ce/osv/malicious/pypi/python-walletlibr-v/MAL-2026-14488.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/27544b01e84dd658593ef8e132d2906cf04dd4ce/osv/malicious/pypi/python-walletlibr-v/MAL-2026-14488.json
- https://pypi.org/project/python-walletlibr-v/0.7.9
- https://github.com/advisories/GHSA-pfrw-v3ch-6m8x

Compromised versions (1)

= 0.7.9

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.