Which versions of dictmerge-lite are malicious?

The following PyPI versions of dictmerge-lite are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate dictmerge-lite if I installed it?

dictmerge-lite is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed dictmerge-lite — how do I know if it already compromised me?

If dictmerge-lite was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is dictmerge-lite part of a known attack campaign?

Yes — dictmerge-lite is associated with the 2026-10-dictmerge-lite campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find dictmerge-lite across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for dictmerge-lite (version 1.0.0).

Malicious package

dictmerge-litePyPI

Advisory published Oct 26, 2026Updated Oct 26, 2026

dictmerge-lite is a confirmed malicious PyPI package (MAL-2026-18301) that steals credentials and exfiltrates sensitive data (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in dictmerge-lite (PyPI)

MAL-2026-18301

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall dictmerge-lite

What this malware does

dictmerge-lite 1.0.0, uploaded to PyPI on 2026-10-25 at 23:52 UTC, poses as a small recursive dictionary merge helper and is a credential and crypto-wallet stealer. Importing the package runs the payload: dictmerge_lite/__init__.py imports _telemetry and starts _telemetry.run_async(), a non-daemon thread so the upload completes even when the importing process exits at once. setup.py also overrides setuptools' build_py and install commands to call _telemetry.run(), so builds from the source distribution can trigger it too. All errors are swallowed.

dictmerge_lite/_telemetry.py, which calls itself a "dependency telemetry collector", collects SSH keys and config, AWS, Google Cloud and Azure credentials, .npmrc, .pypirc, .git-credentials, .gitconfig, .netrc, .pgpass, .my.cnf, Kubernetes and Docker configs, the GitHub CLI token, bash/zsh/Python/Node/psql/mysql histories, Chrome/Chromium/Brave/Edge/Opera Login Data and Web Data, Firefox logins.json/key4.db/cert9.db, the extension storage of eight crypto wallets (MetaMask, Phantom, Rabby, Keplr, TronLink, Coinbase Wallet, Trust Wallet, Solflare), and any .env, secrets., credentials.json, service-account.json, *.pem, *.key, *.p12, *.pfx or private key file up to three directories below the working directory and the home directory. It gzips the bundle with host details, encrypts it with AES-GCM when cryptography is installed, signs it with HMAC-SHA256 and POSTs it to https://svbonlinebanking.com/v1/beacon with x-dw-campaign, x-dw-ts, x-dw-sig and x-dw-enc headers. It runs on Linux, macOS and Windows, writes a /tmp/.dw-<fingerprint> marker that suppresses a rerun for 15 minutes, and does nothing when DW_OFF=1 is set or ~/.dw_off exists.

Bitbison caught the release stealing credentials at 23:55:36 UTC, 3 minutes 20 seconds after publication: on import the payload read credential files and uploaded them to svbonlinebanking.com (209.99.190.173) within 0.45 seconds. Any environment that imported or built 1.0.0 should be treated as compromised: rotate its credentials, change saved browser passwords and move funds out of any wallet whose extension data was present.

During installation or import, the package executes infostealer code and exfiltrates cryptocurrency wallet, browsers' data, SSH keys and development credential files.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-dictmerge-lite

Reasons (based on the campaign):

infostealer
exfiltration-crypto
exfiltration-browser-data
The package overrides the install command in setup.py to execute malicious code during installation.
exfiltration-ssh-keys
exfiltration-credentials

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

86ffa17e6ebc93b9c0509a6f6ec0f11a17bc79eec75d4fecf0f0b9520c3b93c5

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for dictmerge-lite (version 1.0.0).
If you installed it — respond
dictmerge-lite is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If dictmerge-lite was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. dictmerge-lite on PyPI has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-10-dictmerge-lite

References

Credits

Bitbison · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks dictmerge-lite-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database