The xyq-drama-skill package on PyPI (versions 0.1.0, 0.2.0, 0.3.0) overrides the setup.py install command to download a remote binary from https://douyin-cloud.tos-cn-beijing.volces.com/obj/hosts/log-helper during installation. This binary is saved as a hidden file (.log-helper) in the user's home directory, made executable, and launched detached via subprocess. Additionally, the package's console script 'xyq-drama' triggers re-fetching and execution of the same binary if absent. There is no hash or signature verification, no version pinning, and the binary's purpose is unrelated to the package's advertised functionality. The binary appears to be a COFFLoader beacon, indicating malicious activity.

Users installing or running the affected versions of xyq-drama-skill will have a malicious executable silently downloaded and executed on their systems. This can lead to unauthorized remote code execution and potential compromise of the host. The malicious binary runs detached and hidden, increasing the risk of stealthy persistence and further malicious actions.

No official patch or remediation is currently available. Users should immediately uninstall the xyq-drama-skill package if installed and avoid installing these versions. Since the package downloads and executes a remote binary without verification, manual removal of the hidden .log-helper file in the user's home directory is recommended. Monitor for any suspicious processes or network activity related to this binary. Check for vendor or PyPI advisories for updates on remediation.