MAL-2026-17197 — Malicious code in coinscan (PyPI)

Code executed during installation of the coinscan package loads and executes encrypted malicious content. An embedded fallback payload allows execution even when offline. The content contains an infostealer that collects sensitive data and exfiltrates it to a C2 server retrieved from Polygon blockchain transaction history.