The 'defi-tools' PyPI package version 0.8.0 includes malicious code that executes on import. It decodes and writes a ~486KB Linux ELF binary to a hidden directory with full permissions and sets up a cron job to run this binary bi-daily. The binary is designed to steal cryptocurrency wallet data, encrypt it with RSA, and exfiltrate the data to external services such as file-sharing platforms or IPFS. The package also deletes its own dist-info, egg-info, and __pycache__ directories to erase traces of the infection. This campaign is categorized as malicious with clear intent to steal sensitive crypto-related information and maintain persistence on infected systems.

This malicious package compromises systems by installing a persistent backdoor that steals cryptocurrency wallet data. The stolen data is encrypted and exfiltrated to external services, potentially leading to financial loss for affected users. The persistence mechanism via cron jobs ensures ongoing data theft. The removal of package metadata and cache directories complicates detection and forensic analysis.

No official patch or remediation is currently available for this malicious package. Users should avoid installing or using 'defi-tools' version 0.8.0 from PyPI. If already installed, remove the package immediately, delete the dropped binary (~/.config/.npm-cache/snapd-network), and remove the associated cron job (0 */12 * * *). Conduct a thorough system scan for other indicators of compromise. Monitor for suspicious processes and network activity related to file-sharing or IPFS uploads. Check vendor advisories or PyPI for updates or removal notices regarding this package.