The fast-dotenv PyPI package version 1.0.0 includes a delayed-activation malicious payload that, after a randomized 72–96 hour dormancy, fetches a JSON C2 configuration from base64-obfuscated dead-drop URLs. It collects host identity, environment variables containing sensitive keywords (e.g., key, secret, token, password, auth, private, wallet, seed, mnemonic), and enumerates SSH key files in the user's ~/.ssh/ directory. The C2 URLs are concealed within the code as base64 literals with misleading comments to evade detection. Although the analyzed version did not exfiltrate SSH key contents, the overall behavior is consistent with a staged supply-chain credential stealer. The malicious infrastructure is linked to GitHub and GitLab accounts hosting similar code in other languages. The package is classified as malicious with clear intent to steal credentials.

The malicious code can exfiltrate sensitive environment variables and enumerate SSH key files, potentially exposing credentials and secrets stored on the affected system. This can lead to credential theft and unauthorized access to systems or services. The delayed activation and obfuscation techniques increase the difficulty of early detection. No known exploits in the wild have been reported yet.

No official patch or remediation is currently available for fast-dotenv version 1.0.0. Users should immediately remove this package from their environments and avoid using it. Since this is a supply-chain threat, verify dependencies carefully and consider using trusted package sources or internal mirrors. Monitor for any suspicious network activity related to the described C2 patterns. Patch status is not yet confirmed — check the vendor advisory or PyPI security advisories for current remediation guidance.