alphalend-layoutsPyPI
alphalend-layouts is a confirmed malicious PyPI package (MAL-2026-13473) that steals credentials and exfiltrates sensitive data (malicious versions 4.0.0, 4.0.1, 4.0.2…). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in alphalend-layouts (PyPI)
What this malware does
The package harvests installer-side secrets and uploads them to an attacker-controlled GitHub repository, executing both when pip install alphalend-layouts runs (via custom install/develop cmdclass subclasses in setup.py that invoke _compat._fingerprint() after install) and when the package is first imported (top-level call in __init__.py). _candidate_files() reads ~/.sui/sui.keystore, ~/.sui/sui_config/*.yaml/client.yaml, and .env* files filtered by the markers SUI_, PK_B64, and PRIVATE_KEY. _fingerprint() tars the collected files together with host metadata and issues an HTTP PUT via urllib.request to https://api.github.com/repos/futongwan/sui-research-notes/contents/fingerprints/<ts>-<pid>.tar.gz. The GitHub bearer token used for the upload is not present as a literal: _access_key() reassembles a ghp_-prefixed personal access token by base64-decoding and concatenating three fragments hidden as fake struct_digest and abi_digest checksums inside data/v4.json plus a _COMPAT_TAG constant in _compat.py. Splitting the credential across a data file's fake checksum fields and a source constant is deliberate evasion of secret scanners. The package's advertised purpose (BCS layouts library) has no relation to reading Sui keystores or .env secrets or uploading archives to a third-party GitHub repository.
During import, the package exfiltrates sensitive files with SUI private keys to a private GitHub repository. This action is also triggered on every Python startup due to leveraging PTH files.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-alphalend-layouts
Reasons (based on the campaign):
-
files-exfiltration
-
obfuscation
-
crypto-related
-
exfiltration-crypto
-
abuses-pth
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for alphalend-layouts (4 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging alphalend-layouts across your stack and pipelines.
If you installed it — respond
alphalend-layouts is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If alphalend-layouts was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks alphalend-layouts before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
- Kamil Mańkowski (kam193) · reporter
Detect & block this
O3 blocks alphalend-layouts-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.