StackExchange abused to spread malicious PyPi packages as answers

Researchers at Checkmarx uncovered a campaign where threat actors uploaded malicious Python packages to PyPI (e.g., spl-types, raydium, sol-structs, sol-instruct, raydium-sdk), promoted them via StackExchange answers to reach Solana/Raydium developers, and used an update to deliver an info-stealer that harvests browser data, messaging app content, crypto wallet details, targeted files and screenshots and exfiltrates data to a Telegram channel; the packages were downloaded 2,082 times before removal.