The jupiter-sdk PyPI package versions 0.1.0 and 0.1.1 are malicious. Upon import, the package's __init__.py fetches a remote script from an IPFS gateway and executes it directly using exec() without signature or hash verification beyond the IPFS CID. The executed script steals sensitive information including cryptocurrency wallet private keys, SSH keys, and environment files, uploading them to IPFS. It then communicates with a command-and-control server to receive further commands. The package's API functions return hardcoded dummy values and do not perform any legitimate Jupiter DEX aggregation. This behavior constitutes arbitrary remote code execution and data exfiltration triggered by simply importing the package.

This malicious package enables arbitrary remote code execution on any system that imports it, leading to the theft of sensitive data such as cryptocurrency wallet keys, SSH keys, and environment configuration files. The stolen data is exfiltrated to IPFS, potentially exposing private credentials and secrets. The package also establishes communication with a command-and-control server, allowing attackers to execute further commands on the compromised system. This poses a severe risk to confidentiality and system integrity for affected users.

No official patch or remediation is currently available for this malicious package. Users should immediately uninstall jupiter-sdk versions 0.1.0 and 0.1.1 and avoid installing or importing this package. Verify the authenticity of packages before installation, especially those with names similar to popular projects (typosquatting). Monitor for any unauthorized access or data exfiltration resulting from prior use. Consider using trusted package sources and tools that detect malicious packages. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.