metemask-sdk is a malicious PyPI package designed as a typosquat of metamask-sdk. Its __init__.py performs an outbound HTTP fetch to an IPFS gateway to retrieve and execute remote code without any integrity verification. This remote code harvests sensitive data including crypto wallet private keys, SSH keys, and dotenv files, exfiltrating them via IPFS. It also establishes communication with a command-and-control server to receive further commands. The package's public API functions are stubs returning random or constant data, masking its true malicious behavior executed at import time.

Users who install or import metemask-sdk versions 1.2.0 or 1.2.1 risk executing attacker-controlled code on their systems. This leads to theft of sensitive credentials such as cryptocurrency wallet private keys, SSH keys, and environment configuration files. The attacker can also execute additional commands remotely, potentially compromising the victim's environment further. The malicious package poses a significant risk to confidentiality and system integrity.

Avoid installing or using the metemask-sdk package, especially versions 1.2.0 and 1.2.1. Use the legitimate metamask-sdk package instead. Since this is a malicious typosquat package with no official fix or patch, remediation involves removing any installations of metemask-sdk and scanning affected systems for potential compromise. Monitor for unauthorized access or data exfiltration related to the compromised environment. Verify package names carefully before installation to prevent typosquatting attacks.