Skip to content
OpenAdvisories
Unscored PYSEC-2024-152

aiocpa 0.1.13 contains credential harvesting code

Published Nov 25, 2024 · Assigned by PYSEC

Description

aiocpa is a user-facing library for generating color gradients of text.
Version 0.1.13 introduced obfuscated, malicious code targeting
Crypto Pay users, forwarding client credentials to a remote Telegram bot.
All versions have been removed from PyPI.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI aiocpa 0.1.13, 0.1.14 — PYSEC-2024-152

References