The same obfuscated infostealer payload that Armando found in aiocpa v0.1.13 was carried forward -- unchanged -- into v0.1.14, published on November 20, 2024, the same day as v0.1.13. aiocpa is a PyPI package offering a sync and async client for the Telegram CryptoPay API. The payload sits in a single utility file and executes automatically at import time with no user interaction required. PyPI has since removed the package. All 15 published versions are malicious, and the package recorded 12,815 total downloads before removal.
Key Findings
- Malicious version: v0.1.14, published 2024-11-20; all versions of this package are flagged malicious
- Entry point: Import-time execution -- the payload fires the moment the package is imported, no install hook required
- Targets: Python developers using the CryptoPay API on any platform
- Evasion: Payload is obfuscated with base64 encoding and zlib compression; the byte string is reversed before decoding to further hinder static analysis
- Detection: Script-Python.Infostealer.SupplyChain, Text.Infostealer.SupplyChain, Archive-ZIP.Infostealer.SupplyChain, Archive-GZIP.Infostealer.SupplyChain
Package Background
aiocpa presents itself as a legitimate sync and async client for the Telegram CryptoPay API -- a service used by developers to integrate cryptocurrency payment functionality into Telegram bots and web applications. The package was first published on September 1, 2024 under the PyPI account VoVcHiC (email: tsvetkovvova17@gmail.com) and grew to 15 versions before being removed. With 12,815 total downloads, aiocpa had built a footprint among CryptoPay API developers. A second package under the same publisher account, chsu_schedule_api, is also flagged malicious, indicating that VoVcHiC is a purpose-built campaign account rather than a compromised legitimate developer.
Attack Analysis
v0.1.14 carries the same payload as v0.1.13, demonstrating the attacker's intent to keep the malicious code consistent across releases rather than evolve the technique. Both versions were published on the same day -- November 20, 2024 -- suggesting a deliberate release strategy to maximize reach. A developer who updated from v0.1.13 to v0.1.14 would receive the identical infostealer.
The attack works by modifying a single file: . The rest of the package code is functionally intact and closely mirrors a legitimate CryptoPay API client, complete with proper documentation strings, type annotations, and API reference links. The payload is injected at the end of , the module responsible for wrapping async methods into synchronous equivalents. Because this module is imported by the main module, the payload executes for any developer who imports the package regardless of whether they use the sync or async interface.
%22%3E%0A%20%20%20%20%20%20%3Crect%20width%3D%2210%22%20height%3D%2220%22%20fill%3D%22%23f2930d%22%2F%3E%0A%20%20%20%20%20%20%3Crect%20x%3D%2210%22%20width%3D%2210%22%20height%3D%2220%22%20fill%3D%22%230d0d0d%22%2F%3E%0A%20%20%20%20%3C%2Fpattern%3E%0A%20%20%3C%2Fdefs%3E%0A%20%20%3Crect%20width%3D%221200%22%20height%3D%226%22%20fill%3D%22url(%23caution-stripe)%22%2F%3E%0A%3C%2Fsvg%3E){kind=small}