cosmos-gradio versions 9999.0.0 and 9999.0.1 are malicious PyPI packages that perform dependency confusion attacks by publishing an artificially high version number to override legitimate internal packages. The package's setup.py script executes during installation, and the __init__.py runs on import, both sending the installer's hostname, OS username, and current working directory to the domain oob.asyncrun.in. Data exfiltration occurs via out-of-band DNS queries with base32-encoded data in subdomains and HTTP GET requests with query parameters, attempting HTTPS first and falling back to HTTP. The package is sdist-only to ensure setup.py execution and has no other purpose than information theft.

Installation or import of the affected cosmos-gradio package versions leads to unauthorized exfiltration of basic system information (hostname, OS username, current directory) to an attacker-controlled domain. This can lead to privacy breaches and potential reconnaissance for further attacks. There is no indication of code execution beyond the setup.py install-time script or additional payloads. No known exploits in the wild have been reported.

Avoid installing the cosmos-gradio package versions 9999.0.0 and 9999.0.1 from PyPI. Use internal package indexes and strict dependency resolution policies to prevent dependency confusion attacks. Since no official patch or fix exists, do not use these malicious versions. Remove any installations of these versions and monitor for unauthorized network traffic to the domain oob.asyncrun.in. Consider using package allowlists and verifying package provenance before installation.