PyPI typosquat infostealer campaign (donutautosellsrc): claudeopuseni, claudeopusenifile, dictmerge-lite — malicious packages steal credentials, wallets and browser data
Severity: critical · Patch status: no-fix-needed · Since 2026-10-26
GitHub Advisory Database published three malware advisories for malicious PyPI packages tied to the 'donutautosellsrc' campaign. claudeopuseni (0.1.0, 0.1.1) and claudeopusenifile (0.1.3) use obfuscated install-time code to fetch a payload hidden via steganography in an image — a Python app with a native extension module containing an obfuscated infostealer; the C2 server address is retrieved from Polygon blockchain transaction history, and the package includes sandbox-detection and remote-executable download. dictmerge-lite (1.0.0) overrides the setup.py install command to run an infostealer that exfiltrates crypto wallets, browser data, SSH keys and development credentials. Anyone who installed any of these versions is compromised; there are no fixed versions — the packages must be removed and affected systems treated as breached.
What to do
- Immediately uninstall claudeopuseni, claudeopusenifile and dictmerge-lite and block them in your package index/proxy
- Treat any machine where they were installed as compromised: rotate all credentials, SSH keys, API tokens and browser-saved passwords on those hosts
- Check for cryptocurrency wallet compromise and review wallet activity
- Hunt for signs of the infostealer (unusual outbound traffic, blockchain-retrieved C2, native extension artifacts) and rebuild affected machines
- Audit dependency lockfiles and CI caches for these packages and review install logs for exposure
Sources
All live incidents on Threat Watch
