qlinforge version 0.3.2 is a malicious PyPI package that overrides the setup.py install command to download and execute opaque binaries from a remote IP address. On Linux, it downloads a payload to /tmp/.cache, makes it executable, and runs it with a C2 server argument. On Windows, it uses certutil to download a payload masquerading as svchost2.exe to the Windows Temp directory and executes it. It also writes a qlinforge.pth file into site-packages that runs the dropper on every Python interpreter startup, ensuring persistence independent of package import. The package falsely advertises itself as a benign data validation and formatting toolkit with decoy modules to conceal its malicious behavior.

The malicious package can execute arbitrary code on the host system during installation and maintain persistent infection by executing the payload on every Python interpreter startup. This can lead to remote command execution, potential data theft, or further compromise of the affected system. The persistence mechanism is independent of package usage, increasing the risk of unnoticed long-term infection.

No official patch or fix is available for this malicious package. The recommended mitigation is to avoid installing qlinforge version 0.3.2 from PyPI. Remove any installations of this package immediately and scan affected systems for the presence of the downloaded payloads and the qlinforge.pth persistence file. Use trusted sources for Python packages and verify package integrity before installation.