The 'solidity-dev' PyPI package version 1.3.0 includes a malicious payload embedded as a base64-encoded ELF binary. When the package is imported, it decodes and writes this binary to disk with executable permissions and runs it. The binary targets cryptocurrency wallet files and browser wallet extensions, scanning for mnemonic seed phrases including Spanish variants. It encrypts the stolen data with embedded RSA code and uploads it to multiple attacker-controlled endpoints such as api.pinata.cloud, ugu.se, temp.sh, and transfer.sh. Persistence is achieved by adding a cron job that runs the payload every 12 hours. The package name and description serve as a cover to disguise its malicious intent.

This malicious package compromises the confidentiality of cryptocurrency wallet credentials and seed phrases stored locally or in browser extensions, enabling attackers to potentially steal cryptocurrency assets. The persistence mechanism ensures ongoing data theft by periodically re-executing the payload. The package does not provide any legitimate functionality and poses a direct threat to users who install or import it.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately uninstall and avoid using the 'solidity-dev' package version 1.3.0. Users should verify their systems for the presence of the dropped ELF binary and remove any unauthorized cron jobs that execute it. Additionally, users should consider rotating any compromised cryptocurrency wallets and keys. Monitor vendor advisories or PyPI security notices for updates or removal of the package from repositories.