HIGHLY_SUSPICIOUS (1) campaign cataloged at 2026-05-15(2).
- Packages that are likely malicious, but due to the obfuscation level, lack of time or clear indicators it's hard to say what exactly they do; the highest risk of false positives.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2026-05-workweaver¶
The code contains multiple incorrect cryptocurrency addresses among official fee/program/contract addresses. It's difficult to assess if the changes are intentional or results of AI hallucination. The fake addresses are quite similar to the expected official addresses. Using the library could result in invalid transfers or transactions to unintended addresses.
Abuse categories¶
crypto-related
Malicious activity is related to cryptocurrencies or blockchain, e.g. stealing crypto wallets.
References¶
Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.