The 'proxy-checker-j' package (version 0.1.0) published on PyPI includes a malicious Go SSH daemon that creates a reverse tunnel to an attacker-controlled relay. The daemon listens locally for SSH connections authorized by a single embedded ed25519 public key, granting the attacker full shell and command execution capabilities, as well as TCP port forwarding. Persistence is achieved by writing device identity files to multiple locations on the host. This design allows the attacker to bypass network restrictions and maintain durable remote access under the guise of a proxy checking tool.

An attacker controlling the private key matching the embedded public key can gain full interactive shell access, execute arbitrary commands, and perform TCP port forwarding on the compromised host. The reverse tunnel bypasses NAT and firewall restrictions, enabling persistent remote access. This effectively compromises the confidentiality, integrity, and availability of the affected system.

No official patch or remediation is currently available. Users should immediately uninstall the 'proxy-checker-j' package version 0.1.0 and remove any related files such as '~/.config/.device_lock', '/dev/shm/.device_lock', and '/tmp/.device_lock'. Monitor for any unauthorized SSH tunnels or unusual network connections to unknown relays. Avoid installing packages from untrusted sources and verify package authenticity before installation. Check the vendor or PyPI advisories for any updates or official guidance.