Watch Out: These PyPI Python Packages Can Drain Your Crypto Wallets

ReversingLabs uncovered a supply-chain campaign called BIPClip in which seven malicious PyPI packages (including hashdecrypts, bip39-mnemonic-decrypt and others) were designed to harvest BIP39 mnemonic seed phrases and exfiltrate them to actor-controlled servers; the packages were downloaded ~7,451 times before removal. The actors used deceptive package naming, dependency-based staging, a GitHub account (HashSnake) and social channels to distribute and advertise tools, indicating targeted efforts to compromise cryptocurrency wallets via open-source repositories.