CERT24MAL-2026-18301 — Malicious code in dictmerge-lite (PyPI)
dictmerge-lite 1.0.0 was uploaded to PyPI on 2026-10-25. It presents itself as a recursive dictionary merge helper but executes infostealer code on import and when built from source. It collects credentials, browser data, SSH keys, development-tool configuration and cryptocurrency-wallet extension data, and sends them to svbonlinebanking.com.