Multiple Malicious Python Packages Targeting Bittensor Crypto Developers

Malware

SafeDep Team

• Aug 12, 2025 • 2 min read

TL;DR

Multiple malicious Python packages targeting crypto developers and their applications were discovered on PyPI. The packages were used to steal funds by executing a stealthy staking operation. In this specific case, the attackers hooked a legitimate staking function to redirect the funds to their own wallet. The attack leveraged typosquatting to target the popular bittensor package.

Following malicious packages were disclosed by GitLab Vulnerability Research Team:

bitensor@9.9.4
bittenso-cli@9.9.4
qbittensor@9.9.4
bitensor@9.9.5
bittenso@9.9.5

How SafeDep can protect developers?

SafeDep open source tools especially vet and pmg can help protect developers from malicious packages and other open source software supply chain attacks.

Our automated systems flagged the packages as suspicious due to multiple signals, including identifying the malicious code and intention in typosquatting packages. See example

Hardcoded destination wallet address 5FjgkuPzAQHax3hXsSkNtue8E7moEYjTgrDDGxBvCzxc1nqR
Forced transfer_all=True indicating operations without user consent

Malicious Package	SafeDep Analysis	Flagged At
`bitensor@9.9.4`	Link	8/6/2025, 2:53:48 AM
`bittenso-cli@9.9.4`	Link	8/6/2025, 2:59:52 AM
`qbittensor@9.9.4`	Link	8/6/2025, 3:03:45 AM
`bitensor@9.9.5`	Link	8/6/2025, 3:16:03 AM
`bittenso@9.9.5`	Link	8/6/2025, 3:17:10 AM

SafeDep vet alerted users in CI/CD pipelines when trying to add any of the compromised package through a PR.

vet Bittensor Example

SafeDep pmg will alert developers when trying to install any of the compromised package.

pmg Bittensor Example

How to protect your project?

At SafeDep, we believe code is the source of truth. We perform code analysis to detect vulnerabilities and malicious code in open source packages. If that is not feasible, general security best practices can be used to protect against common open source software supply chain attacks.

Always vet open source packages for vulnerabilities and malicious code before use
Ensure branch protection rules require code review before merging
Establish trust on packages through its popularity, community or code review
Avoid using most recently released package versions
Prefer using open source packages only from trusted sources

SafeDep vet seamlessly integrates with your CI/CD pipeline and alerts you when trying to add any of the compromised package through a PR. SafeDep pmg will alert developers when trying to install any of the compromised package.

References

GitLab Uncovers Bittensor Theft Campaign via PyPI

pypi
oss
malware
crypto

Author

SafeDep Team

safedep.io

Share

Malware

Joyfill npm Packages Compromised with Blockchain C2 Loader

Malicious beta versions of @joyfill/components and @joyfill/layouts published on July 28, 2026 carried the PolinRider blockchain dead drop loader inside their production bundles. The Tron-to-BSC C2...

Malware

@copilot-mcp/apex: A macOS Infostealer Re-Published on npm After Takedown

The npm security team removed the original @apexfdn/apex package for malicious code, and the operator re-published the same postinstall macOS infostealer as @copilot-mcp/apex about 11 hours later. It...

Malware

mrmustard PyPI Package Trojanized to Steal Credentials

Version 0.7.4 of Xanadu's mrmustard quantum computing library shipped to PyPI with no matching GitHub release. It carries a 258-line credential stealer that harvests SSH keys, AWS and Kubernetes...

Malware

AsyncAPI Packages Compromised with Miasma RAT

Four @asyncapi npm packages were published with obfuscated malware on July 14, 2026 via compromised CI workflows. The payload downloads Miasma RAT, a credential stealer targeting browsers, SSH keys,...