Which versions of bittensor-emission-tracker are malicious?

The following PyPI versions of bittensor-emission-tracker are flagged malicious: 1.0.1. Treat any of these as compromised.

How do I remediate bittensor-emission-tracker if I installed it?

bittensor-emission-tracker is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed bittensor-emission-tracker — how do I know if it already compromised me?

If bittensor-emission-tracker was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is bittensor-emission-tracker part of a known attack campaign?

Yes — bittensor-emission-tracker is associated with the 2026-06-clip-logger, IN-MAL-2026-005644 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find bittensor-emission-tracker across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for bittensor-emission-tracker (version 1.0.1).

Part of a larger attack: 2026-06-clip-logger published 9 malicious packages. See the full campaign →

Malicious package

bittensor-emission-trackerPyPI

Advisory published Jun 9, 2026Updated Jun 11, 2026

bittensor-emission-tracker is a confirmed malicious PyPI package (MAL-2026-5489) that steals credentials and exfiltrates sensitive data (malicious version 1.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in bittensor-emission-tracker (PyPI)

MAL-2026-5489

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall bittensor-emission-tracker

What this malware does

The package advertises Bittensor subnet burn-rate monitoring but ships a Cython-compiled darwin.so (core.cpython-310-darwin.so) containing an undocumented clipboard-monitoring daemon. Strings in the binary reveal functions _normalize_clipboard_text, _clipboard_fingerprint, _valid_clipboard_text, and docstrings 'Start clipboard daemon if not running', 'Exclusive lock so only one _run daemon polls clipboard', 'Send Telegram for a phrase. Skips if already sent.', and 'Atomically claim text (SQLite). Returns False if already sent.' — a polling clipboard scraper that deduplicates captured phrases via SQLite and ships each new one to Telegram. The bundled bittensor_emission_tracker/defaults.env hardcodes TELEGRAM_BOT_TOKEN=8666228137:AAF_NLMrow4cDf3uEJCl3JY7DeBHtovd1TU and TELEGRAM_CHAT_ID=8766781014 as the default exfiltration sink for every installer who does not manually override via install --telegram_token. The package's install subcommand registers cross-platform autostart (Windows Task Scheduler with battery/time-limit overrides, Linux systemd user service, macOS LaunchAgent) so the daemon persists across reboots and logins. Distribution as a darwin-only compiled.so with no.pyx source in the wheel conceals the clipboard code path from casual inspection while the README only documents burn-rate alerts. Installing or running this package causes long-term, reboot-persistent exfiltration of any sensitive text the user copies (passwords, seed phrases, API keys, private messages) to the author's Telegram channel.

The package contains code to steal clipboard content to a predefined remote location. If run in the right way, the code will periodically check the clipboard and if the content matches the pattern, exfiltrates it. The targeted data are likely cryptocurrency secret seed phrases.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-clip-logger

Reasons (based on the campaign):

clipboard-stealing
crypto-related

Malicious versions

1 flagged

1.0.1

Indicators of compromise (SHA-256)

bdbfe7300548c4332240de0e45338900797b52beefa4867e4d08b8809a0fd950

ca5db94f9840938f43eca692c1176b72bbd94a2f86a694c3293853f39b886a2f

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for bittensor-emission-tracker (version 1.0.1).
If you installed it — respond
bittensor-emission-tracker is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If bittensor-emission-tracker was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. bittensor-emission-tracker on PyPI has been identified as a malicious package (version 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-06-clip-loggerIN-MAL-2026-005644

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks bittensor-emission-tracker-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database