The 'data-harvester' PyPI package version 0.3.1 is a malicious package that embeds a ~486KB Linux ELF binary within its __init__.py file. Upon first import, it decodes and writes this binary to a hidden location (~/.config/.npm-cache/snapd-network) with mode 0777, then installs a user cron job to execute the binary every 12 hours. The binary masquerades as a system service but does not correspond to any legitimate npm or snapd path. The malicious payload steals cryptocurrency wallet data, encrypts it with embedded RSA, and exfiltrates the data to external file-sharing services or IPFS. The package also deletes its own dist-info, egg-info, and __pycache__ directories to hinder detection. This behavior is confirmed by multiple sources and is categorized as a malicious campaign targeting crypto assets with persistence and exfiltration capabilities.

The malicious package compromises systems by installing a persistent backdoor that periodically executes a cryptocurrency wallet stealer. This can lead to theft of sensitive crypto wallet data, resulting in financial loss for affected users. The removal of package metadata and cache directories complicates detection and forensic analysis. There is no indication of exploitation in the wild yet, but the potential impact on users who install this package is significant.

No official patch or remediation is available for this malicious package version. The package should be considered untrusted and immediately removed from any environment where it is installed. Users should avoid installing or importing 'data-harvester' version 0.3.1 from PyPI. Review and remove any cron jobs or dropped binaries associated with this package. Monitor for any unauthorized persistence mechanisms. Since this is a malicious package, remediation involves removal and prevention of installation rather than patching.