Malicious PyPI crypto pay package aiocpa implants infostealer code

ReversingLabs detected a malicious PyPI package, "aiocpa", that contained obfuscated infostealer code designed to exfiltrate cryptocurrency-related tokens to a Telegram bot. The attackers published legitimate-looking client versions to build trust, then introduced malicious updates (versions 0.1.13 and 0.1.14) and attempted a package-name takeover; RL’s Spectra platform identified the behavior and PyPI quarantined/removed the package. Provided IOCs include package names, versions, and SHA1 hashes for the malicious releases.