# Import-time credential stealer in packages

Package code that runs on import/require and touches secrets, network, or process memory

_Area: Software supply chain and CI/CD. Seen in 8 disclosed reports; latest 2026-07-25. Updated 2026-10-23._

## How it works
A package's entry module runs code the moment it is imported or required, before any function is called. The assumption that breaks is that installing or importing a library is passive: reviewers and scanners look at install scripts and declared dependencies, not at top-level statements in `__init__.py` or `index.js`. Attackers append or prepend a block that fires unconditionally on load, reads credentials from the environment, files, or process memory, and sends them out. Because nothing is invoked explicitly, install-script scanners and normal usage never see it [E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-node-ipc-npm-supply-chain-attack.md)[E6](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-velora-dex-sdk-compromised-on-npm-malicious-version-drops-macos-backdoor-via-launchctl-persistence.md).

## Where it shows up
- Module-scope calls to setup/fetch functions, or an IIFE appended after `module.exports` [E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-node-ipc-npm-supply-chain-attack.md)[E4](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-teampcp-plants-wav-steganography-credential-stealer-in-telnyx-pypi-package.md)
- New stdlib imports at top level: `subprocess`, `tempfile`, `wave`, `urllib.request`, `base64`, `os` duplicated [E4](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-teampcp-plants-wav-steganography-credential-stealer-in-telnyx-pypi-package.md)
- Obfuscated blobs, custom alphabets, base64/XOR payloads, encrypted archives fetched from a C2 [E1](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-the-hades-campaign-pypi-packages.md)[E4](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-teampcp-plants-wav-steganography-credential-stealer-in-telnyx-pypi-package.md)
- `exec` of a base64-decoded `curl|bash` dropper in the entry file [E6](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-velora-dex-sdk-compromised-on-npm-malicious-version-drops-macos-backdoor-via-launchctl-persistence.md)
- Self-deleting helper functions; code present only in the published tarball, absent from the repo/tag [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-compromised-pypi-mrmustard-0-7-4-credential-stealer.md)[E5](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-bittensor-wallet-4-0-2-compromised-on-pypi-backdoor-exfiltrates-private-keys.md)
- Release workflow attestation removed; registry-only publish with no matching commit [E5](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-bittensor-wallet-4-0-2-compromised-on-pypi-backdoor-exfiltrates-private-keys.md)[E6](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-velora-dex-sdk-compromised-on-npm-malicious-version-drops-macos-backdoor-via-launchctl-persistence.md)
- Memory access to `/proc/*/mem`, `ReadProcessMemory`, `task_for_pid`; OIDC env vars used to mint registry tokens [E1](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-the-hades-campaign-pypi-packages.md)

## How to review
Diff the published artifact against the upstream source tag, not just version to version. The invariant: no code at import time may read credentials, spawn processes, or make network calls. Confirm every top-level statement is a definition, import, or constant. Check that a git tag/release exists for the version and that attestation/provenance is intact. For native-backed packages, review the Rust/C source in the sdist, not only the Python wrapper [E5](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-bittensor-wallet-4-0-2-compromised-on-pypi-backdoor-exfiltrates-private-keys.md).

## Variants seen
- Python `__init__.py` import hook downloading and decrypting a Bun payload [E1](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-the-hades-campaign-pypi-packages.md)
- 258-line stealer injected only into the PyPI tarball, no matching tag [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-compromised-pypi-mrmustard-0-7-4-credential-stealer.md)
- npm IIFE after `module.exports`, no lifecycle hooks, 90+ credential categories [E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-node-ipc-npm-supply-chain-attack.md)
- WAV steganography decoded on import in a Python SDK [E4](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-teampcp-plants-wav-steganography-credential-stealer-in-telnyx-pypi-package.md)
- Rust keyfile-decryption backdoor in the sdist with attestation stripped [E5](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-bittensor-wallet-4-0-2-compromised-on-pypi-backdoor-exfiltrates-private-keys.md)
- Prepended `exec` dropper in `dist/index.js` with launchctl persistence [E6](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-velora-dex-sdk-compromised-on-npm-malicious-version-drops-macos-backdoor-via-launchctl-persistence.md)

## Impact and severity
Full credential theft from developer machines and CI runners: SSH, cloud, Kubernetes keys, private wallet keys, and OIDC tokens that enable self-spreading to further packages [E1](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-the-hades-campaign-pypi-packages.md)[E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-compromised-pypi-mrmustard-0-7-4-credential-stealer.md)[E5](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-bittensor-wallet-4-0-2-compromised-on-pypi-backdoor-exfiltrates-private-keys.md). Severity is high because it runs on any import, including in CI. Worse when the artifact differs from the repo and provenance is stripped, hiding the change from source review [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-compromised-pypi-mrmustard-0-7-4-credential-stealer.md)[E5](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-bittensor-wallet-4-0-2-compromised-on-pypi-backdoor-exfiltrates-private-keys.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-the-hades-campaign-pypi-packages.md
- E2: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-compromised-pypi-mrmustard-0-7-4-credential-stealer.md
- E3: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-node-ipc-npm-supply-chain-attack.md
- E4: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-teampcp-plants-wav-steganography-credential-stealer-in-telnyx-pypi-package.md
- E5: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-bittensor-wallet-4-0-2-compromised-on-pypi-backdoor-exfiltrates-private-keys.md
- E6: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-velora-dex-sdk-compromised-on-npm-malicious-version-drops-macos-backdoor-via-launchctl-persistence.md