The 'playwrightr' package on PyPI contains malicious code in its setup.py that registers a CustomInstallCommand executed automatically during 'pip install' on Windows. This command uses Windows HTTP APIs via ctypes to fetch a remote executable from florinn.dev, saves it to the temporary directory, removes NTFS Zone.Identifier alternate data streams to evade Mark-of-the-Web and SmartScreen warnings, and launches the executable hidden from the user. The remote executable acts as a dropper that downloads further payloads, including cryptocurrency miners. The package name is a deliberate one-character typo of the popular 'playwright' package, aiming to trick users into installing it. The package itself contains only a stub function unrelated to its name, indicating no legitimate functionality.

Installation of the 'playwrightr' package on Windows results in execution of attacker-controlled code with the installing user's privileges. This leads to unauthorized remote code execution, potential system compromise, and resource abuse through cryptocurrency mining. The malicious executable employs anti-detection techniques to evade Windows security features, increasing the risk of unnoticed infection.

Users should avoid installing the 'playwrightr' package and verify package names carefully before installation. Since this is a malicious package impersonating a legitimate one, do not install packages with suspicious or near-typo names. There is no official patch or fix because this is a malicious package, not a vulnerability in legitimate software. Remove any installations of 'playwrightr' and scan affected systems for malicious executables and cryptocurrency miners. Use trusted sources and verify package authenticity before installation.