The northstart-sdk PyPI package (versions 0.1.0 through 0.2.2) contains malicious code that triggers upon importing the module. The top-level __init__.py fetches 8 bytes from a hardcoded remote PNG file, uses them as key material for PBKDF2-HMAC-SHA256 to decrypt embedded JSON blobs, and executes the decrypted code via compile() and exec(). The decrypted payload implements a remote-controlled agent that opens an encrypted framed socket connection to an attacker-controlled server. The code includes obfuscated cryptographic routines (XOR, AES-GCM, ChaCha20, Fernet, RSA-OAEP) and transmits user credentials to the remote operator. This mechanism effectively creates a reverse shell allowing arbitrary command execution, concealed through encryption and obfuscation to evade source review.

Importing the affected northstart-sdk package versions results in execution of attacker-controlled code, establishing a remote-controlled encrypted reverse shell on the victim system. This allows an attacker to execute arbitrary commands, potentially leading to full system compromise, data exfiltration, and further malicious activity. The malicious payload is concealed via encryption and obfuscation, increasing the risk of unnoticed compromise.

No official patch or remediation is currently available for northstart-sdk. Users should immediately uninstall the affected package versions (=0.1.0, =0.2.0, =0.2.1, =0.2.2) and avoid installing or importing this package. Monitor for any unexpected network connections or processes related to this package. Check trusted sources and vendor advisories for updates or official fixes. Consider using package integrity verification and supply chain security measures to prevent installation of malicious packages.