This threat involves a typosquatted PyPI package named ethereum-input-decorder, which impersonates the legitimate ethereum-input-decoder package. Upon import, it unconditionally executes code that detects the operating system and architecture, downloads a corresponding binary from easyswapnow.pro or a Google Drive link, writes it to disk, sets executable permissions, and runs it. It also installs persistence mechanisms via systemd user services on Linux and LaunchAgents on macOS to ensure the payload runs on every user login. The package installs a Mythic/Poseidon C2 framework beacon that communicates with a C2 server at wegoexchange.site for further commands. The package metadata is misleading and does not match the actual malicious payload. This campaign is categorized as malicious with clear intent to compromise systems.

Systems that install and import this package will execute malicious binaries that establish persistent backdoors and communicate with attacker-controlled command-and-control servers. This can lead to unauthorized remote control, data theft, or further malware deployment. The persistence mechanisms ensure the malware survives reboots and user logouts, increasing the risk of prolonged compromise.

No official patch or remediation is available since this is a malicious typosquatting package rather than a vulnerability in legitimate software. The recommended mitigation is to avoid installing this package and verify package names carefully before installation. Use only the legitimate ethereum-input-decoder package from trusted sources. Remove any installations of ethereum-input-decorder and related persistence files if found. Monitor for suspicious systemd user services or LaunchAgents related to python-script.service or com.user.script.plist and remove them. Since this is not a cloud service, remediation is user-driven.