ETHEREUM PRIVATE KEY STEALER ON PYPI DOWNLOADED OVER 1K TIMES

Summary from the TLDR InfoSec newsletter

The PyPI package "set-utils" targets Ethereum developers using the eth-account library. The package hooks the from_key and from_mnewmonic() functions in the ethereum package to intercept private keys, encrypt them, and upload them to the Polygon blockchain. Polygon transactions have very low processing fees, no rate limits, and free public RPC endpoints, enabling attackers to retrieve the keys at any point without requiring their own infrastructure.