Researchers have exposed a fast-moving supply-chain campaign that targeted the developers behind cryptocurrency wallets, using poisoned pull requests, a fake security report and a booby-trapped Rust crate. The campaign, run from a GitHub account called sapho11, unfolded over about six hours on 10 November 2026, according to research published that day by OpenSourceMalware and summarised by Corgea.

The targets were wallet projects in the Zcash, Vizor, Keplr and Cosmos ecosystems, including Chainapsis's Vizor Wallet and Zingo Labs. No CVE number has been assigned to the campaign, which is tracked under GitHub advisory GHSA-8mh3-cf36-7xxq. The aim was not to attack wallet users directly, but to steal the signing keys and credentials of the developers who build and release the wallets.

Poisoned pull requests stole signing keys

The account was created at 01:26 UTC on 10 November. About half an hour later it opened two pull requests against the Vizor Wallet repository, numbered 1199 and 1200. The first added code that collected secret environment variables from the project's build system. The second went further, hunting through those variables for file paths ending in signing-certificate formats such as .pfx, .p12, .keystore and .pem, then reading the matching files, including Fastlane signing material and private keys.

An automated code-review bot flagged the exfiltration on both pull requests. The attacker then changed tack: pull request 1201 rewrote the project's AGENTS.md file to add an "Automation Diagnostics Convention" telling AI code reviewers — and human ones — to treat the uploads of environment snapshots and signing variables as expected behaviour, and not to flag them as credential leaks.

Fake security report led to a phishing page

Minutes before that pull request, the same account opened a fake vulnerability report on its own fork of the project, tagging two Vizor maintainers. The report pointed to a login page hosted on Cloudflare Workers that mimicked GitHub's sign-in screen and collected usernames and passwords. It was, in short, a phishing trap dressed up as a responsible disclosure.

The malicious Rust crate is still live

From 03:05 UTC the account published eight versions of a Rust crate called lwd-uri-util, versions 0.1.0 to 0.1.7, to crates.io, presenting it as a helper for Zcash lightwalletd endpoint addresses. The crate's main code is a short address normaliser, but its build script runs automatically whenever the crate is compiled — including during a routine cargo check or when an editor's rust-analyzer indexes the project.

That build script collects environment variables and credential files, including .env files, AWS credentials, Cargo and npm credentials, Git credentials, and Keplr MCP vaults, and tries to send them to an attacker-controlled server. It also attempts to read macOS Keychain passwords for Keplr, Vizor and Fastlane services. All eight versions were still live and un-yanked on crates.io as of 10 November 2026, according to the researchers.

The attacker then opened further pull requests adding the crate as a dependency: one more against Vizor Wallet, and two against Zingo Labs projects. Vizor closed all four of its pull requests; the two Zingo Labs pull requests were still open when the research was published. The additions were hidden inside full-file rewrites that changed line endings, so the diff viewer showed more than a thousand changed lines around a 25-line dependency change.

Related wallet drain disclosed the same day

The same research roundup disclosed a separate incident: version 14.4.2 of the Python package fragment-api-py, uploaded to PyPI on 8 November with no matching GitHub commit or tag, drained funds from Telegram Fragment wallets on startup. Two production wallets lost 0.88 TON on 8 November and 43.98 TON on 9 November, with 44.87 TON cashed out on 10 November. Version 14.4.2 has been removed from PyPI and 14.4.1 is the clean version. The researchers do not link this package to the sapho11 account.

What developers should do now

Do not check out or build the affected pull requests, and do not add lwd-uri-util to any project. Search build trees for lwd-uri-util and for the file lwd_uri_build_context.json, which the crate writes, and treat any machine that built it as compromised: rotate credentials, signing keys and tokens that may have been exposed. Pin fragment-api-py to version 14.4.1 or earlier, and move any remaining funds out of TON wallets whose seed was passed to version 14.4.2.