THREATPKG
SYNC STALE

Supply-chain threat intelligence

Incident detail

criticalpypi·credential theft·osv

Malicious code in bittensor-burn-watch (PyPI)

bittensor-burn-watch

Risk score

92

AI summary

Indexed incident for bittensor-burn-watch (pypi).

Description

The package contains code to steal clipboard content to a predefined remote location. If run in the right way, the code will periodically check the clipboard and if the content matches the pattern, exfiltrates it. Early versions contain this behavior mentioned in the README. The targeted data are likely cryptocurrency secret phrases.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-clip-logger

Reasons (based on the campaign):

  • clipboard-stealing

  • crypto-related

Technical details

Indicators

  • affected version<function fixed() { [native code] }75%
  • affected version<function fixed() { [native code] }75%
  • affected version<function fixed() { [native code] }75%
  • affected version<function fixed() { [native code] }75%
  • affected version<function fixed() { [native code] }75%
  • affected version<function fixed() { [native code] }75%
  • affected version<function fixed() { [native code] }75%
  • affected version<function fixed() { [native code] }75%
  • affected version<function fixed() { [native code] }75%
  • affected version<function fixed() { [native code] }75%
  • affected version<function fixed() { [native code] }75%
  • affected version<function fixed() { [native code] }75%
  • affected version<function fixed() { [native code] }75%
  • affected version<function fixed() { [native code] }75%
  • affected version<function fixed() { [native code] }75%
  • affected version<function fixed() { [native code] }75%

Timeline

  1. Advisory published
  2. Indexed by ThreatPkg

Related incidents