The py-base58 package versions 2.1.3 and 2.1.4 masquerade as a legitimate base58 encoder but embed a ~640KB base64-encoded Linux ELF binary within base58/_payload.py. Upon first import, this binary is decoded, saved under a name resembling a system daemon in ~/.config/.npm-cache/, given full permissions (chmod 0777), executed, and scheduled to run every 12 hours via a user crontab entry. The binary steals cryptocurrency wallet data including BIP-39 mnemonics and keystore files from wallets like Phantom, MetaMask, Ledger, and Exodus, targeting specific file paths such as ~/.config/solana/id.json and ~/.ethereum/keystore. Stolen data is encrypted with an embedded RSA public key and exfiltrated to public file hosts including api.pinata.cloud (IPFS), uguu.se, temp.sh, and transfer.sh. The package also deletes its own.dist-info/.egg-info directories to hide from pip list and pip show commands, indicating clear malicious intent unrelated to its declared functionality.

This malicious package compromises the security of users by stealing sensitive cryptocurrency wallet credentials and files, enabling attackers to potentially access and drain victims' cryptocurrency assets. The persistence mechanism ensures ongoing data theft every 12 hours. The removal of package metadata hinders detection and remediation efforts by users and security tools relying on package management information.

No official patch or remediation is currently documented. Users should immediately uninstall py-base58 versions 2.1.3 and 2.1.4 if installed. Avoid using these versions and verify package integrity before installation. Monitor for suspicious cron jobs and unexpected binaries in ~/.config/.npm-cache/. Remove any such files and cron entries if found. Since the package removes its own metadata, manual inspection is necessary. Check vendor advisories or PyPI for updates or official guidance.