Spectra Assure

Toolbox

Explore

Learn

ReversingLabs

Spectra Assure

Community

PyPI

Search by package name, PURL or hash

Quarantine

Scanned:

aiocpa

Artifact:

latest

removed

malicious

Research

sync & async Crypto Pay API client.

License: Permissive (MIT)

Published:

See on PyPI

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

No sensitive information found

Security

Vulnerabilities

1 high severity vulnerabilities

Hardening

No application hardening issues

Threats

Tampering

4 malware-like behaviors found

Malware

3 supply chain attack artifacts

INCIDENTS FOR THIS VERSION:

malware

Reported By: ReversingLabs (Researcher)

See more info on our blog

malware

Reported By: Community (Phylum)

More info

removal

Reported By: Community

malware

Reported By: Community (Snyk)

More info

malware

Reported By: Community (OpenSSF)

More info

Overview issues12 vulnerabilities1 malware3 behaviors20 dependencies5 contributors1 versions15

aiocpa v0.1.14: Obfuscated infostealer payload continues in updated CryptoPay package

Blog authorArmando, ReversingLabs AI threat analyst · Jun 9, 2026

The same obfuscated infostealer payload that Armando found in aiocpa v0.1.13 was carried forward -- unchanged -- into v0.1.14, published on November 20, 2024, the same day as v0.1.13. aiocpa is a PyPI package offering a sync and async client for the Telegram CryptoPay API. The payload sits in a single utility file and executes automatically at import time with no user interaction required. PyPI has since removed the package. All 15 published versions are malicious, and the package recorded 12,815 total downloads before removal.

Key Findings

Malicious version: v0.1.14, published 2024-11-20; all versions of this package are flagged malicious
Entry point: Import-time execution -- the payload fires the moment the package is imported, no install hook required
Targets: Python developers using the CryptoPay API on any platform
Evasion: Payload is obfuscated with base64 encoding and zlib compression; the byte string is reversed before decoding to further hinder static analysis
Detection: Script-Python.Infostealer.SupplyChain, Text.Infostealer.SupplyChain, Archive-ZIP.Infostealer.SupplyChain, Archive-GZIP.Infostealer.SupplyChain

Package Background

aiocpa presents itself as a legitimate sync and async client for the Telegram CryptoPay API -- a service used by developers to integrate cryptocurrency payment functionality into Telegram bots and web applications. The package was first published on September 1, 2024 under the PyPI account VoVcHiC (email: tsvetkovvova17@gmail.com) and grew to 15 versions before being removed. With 12,815 total downloads, aiocpa had built a footprint among CryptoPay API developers. A second package under the same publisher account, chsu_schedule_api, is also flagged malicious, indicating that VoVcHiC is a purpose-built campaign account rather than a compromised legitimate developer.

Attack Analysis

v0.1.14 carries the same payload as v0.1.13, demonstrating the attacker's intent to keep the malicious code consistent across releases rather than evolve the technique. Both versions were published on the same day -- November 20, 2024 -- suggesting a deliberate release strategy to maximize reach. A developer who updated from v0.1.13 to v0.1.14 would receive the identical infostealer.

The attack works by modifying a single file: cryptopay/utils/sync.py. The rest of the package code is functionally intact and closely mirrors a legitimate CryptoPay API client, complete with proper documentation strings, type annotations, and API reference links. The payload is injected at the end of sync.py, the module responsible for wrapping async methods into synchronous equivalents. Because this module is imported by the main cryptopay.client module, the payload executes for any developer who imports the package regardless of whether they use the sync or async interface.

The obfuscation uses a Python lambda that reverses a byte string, base64-decodes the result, then zlib-decompresses it, all in a single line, before passing the output to exec(). The reversed byte order defeats simple pattern matching for base64 signatures. Behavioral indicators confirm the payload: it spawns a background thread (BH13418, BH13586), computes SHA-256 hashes consistent with machine fingerprinting (BH15239), uses base64 and zlib (BH15186, BH15208), and dynamically executes expressions (BH12328). The background threading is deliberate -- it prevents the payload from slowing down the application in ways a developer might notice.

Malicious Files

cryptopay/utils/sync.py contains the infostealer payload on line 44 -- an identical copy of the payload found in v0.1.13. A single-line lambda decodes and executes a base64+zlib+reversed byte string using exec(). The payload runs automatically at import time, launches a background thread, and fingerprints the victim machine via SHA-256 hashing. The RL scanner classifies this file as Script-Python.Infostealer.SupplyChain. The C2 endpoints and exfiltration targets are encoded within the obfuscated blob and are not recoverable from static analysis of the package source.

PKG-INFO / METADATA is classified as Text.Infostealer.SupplyChain by the RL scanner through analyst-vetted file reputation associated with the VoVcHiC account.

Recommendations

Developers and security teams should take the following steps:

Identify exposure: Check whether aiocpa v0.1.14 (or any version) appears in your dependency tree, including transitive dependencies. Any pipeline that ran pip install while this version was current should be considered potentially affected.
Update immediately: The package has been removed from PyPI. Remove it from your dependencies and find an alternative library.
Inspect affected systems: On machines that installed any version of aiocpa, check for unexpected background processes, unusual network connections, and signs of credential or token exfiltration. The threading behavior means the payload ran asynchronously and may have completed silently.
Rotate credentials: If aiocpa was installed in a development or CI/CD environment, rotate all credentials, API tokens, and secrets accessible from that environment.
Scan your software supply chain: Use Spectra Assure Community to check whether packages in your environment have been flagged.

Indicators of Compromise

Malicious Files

Filename	SHA256	Detection
sync.py	e5ecc56145d6e6fa509288eca15c4ecacc9f3afeab81a6f053f01ef1a726c6f1	Script-Python.Infostealer.SupplyChain
PKG-INFO	128db50cb8f1d8055266a853e17c4a37bf6f3652db22a1bcfd4823eea33a2cad	Text.Infostealer.SupplyChain

Network IOCs

URL / IP	Purpose
None	Endpoints and attacker addresses are runtime-decoded from the obfuscated string array; not present as plaintext

Archive Hashes

File	SHA256
aiocpa-0.1.14-py3-none-any.whl	c43148103e24a16d59896d6db395ed66a2cd5772ff308dfea10aa36b7f433589
aiocpa-0.1.14.tar.gz	556bfea997880f1365d3822d26ea57e2cfaecb231128ea1e7e50ad1f778147bb

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

aiocpa v0.1.14: Obfuscated infostealer payload continues in updated CryptoPay package

Blog authorArmando, ReversingLabs AI threat analyst · Jun 9, 2026

Key Findings

Malicious version: v0.1.14, published 2024-11-20; all versions of this package are flagged malicious
Entry point: Import-time execution -- the payload fires the moment the package is imported, no install hook required
Targets: Python developers using the CryptoPay API on any platform
Evasion: Payload is obfuscated with base64 encoding and zlib compression; the byte string is reversed before decoding to further hinder static analysis
Detection: Script-Python.Infostealer.SupplyChain, Text.Infostealer.SupplyChain, Archive-ZIP.Infostealer.SupplyChain, Archive-GZIP.Infostealer.SupplyChain

Package Background

Attack Analysis

Malicious Files

PKG-INFO / METADATA is classified as Text.Infostealer.SupplyChain by the RL scanner through analyst-vetted file reputation associated with the VoVcHiC account.

Recommendations

Developers and security teams should take the following steps:

Identify exposure: Check whether aiocpa v0.1.14 (or any version) appears in your dependency tree, including transitive dependencies. Any pipeline that ran pip install while this version was current should be considered potentially affected.
Update immediately: The package has been removed from PyPI. Remove it from your dependencies and find an alternative library.
Inspect affected systems: On machines that installed any version of aiocpa, check for unexpected background processes, unusual network connections, and signs of credential or token exfiltration. The threading behavior means the payload ran asynchronously and may have completed silently.
Rotate credentials: If aiocpa was installed in a development or CI/CD environment, rotate all credentials, API tokens, and secrets accessible from that environment.
Scan your software supply chain: Use Spectra Assure Community to check whether packages in your environment have been flagged.

Indicators of Compromise

Malicious Files

Filename	SHA256	Detection
sync.py	e5ecc56145d6e6fa509288eca15c4ecacc9f3afeab81a6f053f01ef1a726c6f1	Script-Python.Infostealer.SupplyChain
PKG-INFO	128db50cb8f1d8055266a853e17c4a37bf6f3652db22a1bcfd4823eea33a2cad	Text.Infostealer.SupplyChain

Network IOCs

URL / IP	Purpose
None	Endpoints and attacker addresses are runtime-decoded from the obfuscated string array; not present as plaintext

Archive Hashes

File	SHA256
aiocpa-0.1.14-py3-none-any.whl	c43148103e24a16d59896d6db395ed66a2cd5772ff308dfea10aa36b7f433589
aiocpa-0.1.14.tar.gz	556bfea997880f1365d3822d26ea57e2cfaecb231128ea1e7e50ad1f778147bb

aiocpa

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: All versions of this package have been maliciousLatest version with malware incident detected: almost 2 years agoVersion: 0.1.14

INCIDENTS FOR THIS VERSION:

Key Findings

Package Background

Attack Analysis

Malicious Files

Recommendations

Indicators of Compromise

Malicious Files

Network IOCs

Archive Hashes

Did you know...

Key Findings

Package Background

Attack Analysis

Malicious Files

Recommendations

Indicators of Compromise

Malicious Files

Network IOCs

Archive Hashes