Ethereum private key stealer on PyPI downloaded over 1,000 times

A malicious Python Package Index (PyPI)  package named "set-utils" has been stealing Ethereum private keys through intercepted wallet creation functions and exfiltrating them via the Polygon blockchain. The package disguises itself as a utility for Python, mimicking the popular "python-utils," which has over 712 million downloads, and "utils," which counts over 23.5 million installs. Researchers from the developer cybersecurity platform Socket discovered the malicious package and reported that set-utils had been downloaded over a thousand times since its submission on PyPI on January 29, 2025. The open-source supply chain security firm reports that the attacks primarily target blockchain developers utilizing 'eth-account' for wallet creation and management, Python-based DeFi projects, Web3 apps with Ethereum support, and personal wallets using Python automation. As the malicious package is targeting cryptocurrency projects, even though there were only a thousand downloads, it could impact a far larger number of people who used the applications to generate wallets. The malicious set-utils package embeds the attacker's RSA public key to be used for encrypting stolen data and an Ethereum sender account controlled by the attacker. The package hooks into standard Ethereum wallet creation functions like 'from_key()' and 'from_mnewmonic()' to intercept private keys as they are generated on the compromised machine. It then encrypts the stolen private key and embeds it in the data fi...