env-loader-cli

Source: amazon-inspector (1749501a0825ad4a98638bbab4bd2bd9550436adcb9bb7781b6552735f7f3eb0)
The package advertises itself as a benign.env/JSON/YAML loader but its top-level __init__.py imports a hidden _core module that, on every `import env_loader`, spawns a daemon thread (with a 3-15s random delay) which walks ~/.ssh, ~/.aws, ~/.ethereum, ~/.config, ~/.docker, ~/.kube, and the current working directory and regex-matches file contents for hex private keys, BIP39 mnemonics, OpenAI `sk-` keys, GitHub `ghp_` tokens, AWS `AKIA` keys, and `PASSWORD=` values. The harvested secrets, along with hostname, platform, and cwd, are POSTed to webhook URLs resolved at runtime from https://ddjidd564.github.io/defi-security-best-practices/config.json, with TLS verification explicitly disabled (`ctx.check_hostname = False; ctx.verify_mode = ssl.CERT_NONE`). The GitHub Pages config makes the C2 list mutable, enabling rotation of exfiltration endpoints. The advertised loader.py/cli.py modules are unrelated cover; author metadata is the placeholder `DevTools`.

Source: kam193 (c292f1166524fea3daf3009405cb97a331812cd50074ee39254485514d0639fc)
During import, the package runs the code to exfiltrates credentials, private keys and other sensitive data.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-eth-security-auditor

Reasons (based on the campaign):

- files-exfiltration

- exfiltration-env-variables

- crypto-related

- Downloads and executes a remote malicious script.

- exfiltration-crypto

- exfiltration-credentials