Which versions of python-bitget-api are malicious?

The following PyPI versions of python-bitget-api are flagged malicious: 3.1.5, 3.3.5. Treat any of these as compromised.

How do I remediate python-bitget-api if I installed it?

python-bitget-api is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed python-bitget-api — how do I know if it already compromised me?

If python-bitget-api was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is python-bitget-api part of a known attack campaign?

Yes — python-bitget-api is associated with the 2024-12-python-bitget-api campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find python-bitget-api across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for python-bitget-api (2 malicious versions).

Malicious package

python-bitget-apiPyPI

Advisory published Dec 12, 2024Updated Dec 12, 2025

python-bitget-api is a confirmed malicious PyPI package (MAL-2024-12333) that steals credentials and exfiltrates sensitive data (malicious versions 3.1.5, 3.3.5). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in python-bitget-api (PyPI)

MAL-2024-12333

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall python-bitget-api

What this malware does

Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the calculator. On MacOS, the file is identified as a Spark RAT by multiple vendors. Package impersonate the legitimate "python-bitget".

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2024-12-python-bitget-api

Reasons (based on the campaign):

typosquatting
obfuscation
clones-real-package
dependency-confusion
crypto-related
impersonation
Downloads and executes a remote malicious script.

Malicious versions

2 flagged

3.1.53.3.5

Indicators of compromise (SHA-256)

a5fe8ca96d7c776e6075d499136bb772e611074714fe83f965c747eb653b6abc

cac6988c3746b27c0cc34a156657431c2a0c0c36de45c6b88a00130d30dfd66e

29ef7b696db534499045bf5afb8add3b248725e4dd618427f691ace7e0a88929

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for python-bitget-api (2 malicious versions).
If you installed it — respond
python-bitget-api is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If python-bitget-api was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. python-bitget-api on PyPI has been identified as a malicious package (versions 3.1.5, 3.3.5 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2024-12-python-bitget-api

References

Credits

Kamil Mańkowski (kam193)

Detect & block this

O3 blocks python-bitget-api-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database