NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐍 PyPI
Not in CISA KEV

A single post-release of dydx-v4-client contained obfuscated multi-stage loaderGHSA-4f84-67cv-qrv3

GHSA-4f84-67cv-qrv3 is a security vulnerability in dydx-v4-client. A fix is available for dydx-v4-client — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Sep 10, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐍dydx-v4-client

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

A PyPI user account compromised by an attacker and was able to upload a malicious version (1.1.5.post1) of the dydx-v4-client package. This version contains a highly obfuscated multi-stage loader that ultimately executes malicious code on the host system.

While the final payload is not visible because it is tucked away inside 100 layers of encoding, the structural design—specifically the use of recursive decompression followed by an exec() call is a definitive indicator of malicious software, likely a "Crypter" or "Dropper" masquerading as a cryptocurrency-related utility with the intent on connecting to hxxps://dydx[.]priceoracle[.]site/py to download and execute further payloads.

Users of the dydx-v4-client package should immediately uninstall version 1.1.5.post1and revert to the last known good version (1.1.5) or later secure versions once available. Additionally, users should monitor their systems for any unusual activity and consider running security scans to detect any potential compromise.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIdydx-v4-client≥ 1.1.5.post1&&< 1.1.51.1.5pip install --upgrade 'dydx-v4-client==1.1.5'

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for dydx-v4-client, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update dydx-v4-client to 1.1.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-4f84-67cv-qrv3 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

A PyPI user account compromised by an attacker and was able to upload a malicious version (1.1.5.post1) of the `dydx-v4-client` package. This version contains a highly obfuscated multi-stage loader that ultimately executes malicious code on the host system. While the final payload is not visible because it is tucked away inside 100 layers of encoding, the structural design—specifically the use of recursive decompression followed by an `exec()` call is a definitive indicator of malicious software, likely a "Crypter" or "Dropper" masquerading as a cryptocurrency-related utility with the intent
O3 Security · Impact-Aware SCA

Is GHSA-4f84-67cv-qrv3 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
A single post-release of dydx-v4-client contained…