The extra-huggingface PyPI package (version 0.4.0) is a malicious package that impersonates the Hugging Face ecosystem to lure machine learning developers. It includes a native Windows PE module (_native.pyd) that implements a remote access trojan (RAT). The Python code acts as a thin wrapper exposing functions to run the agent, install persistence, and communicate with a hardcoded attacker-controlled server at 91.92.40.212:8080. The agent polls this server to receive commands and maintains persistence by registering itself to run after login or boot. The package exfiltrates sensitive data, including browser data, and is classified as a malicious campaign involving typosquatting, native extensions, persistence, and infostealing.

Systems that install and run this package are compromised by a remote access trojan that allows attackers to execute arbitrary commands remotely. The malware establishes persistence to survive reboots and exfiltrates sensitive user data, including browser information. This leads to unauthorized data disclosure and full remote control of the affected machine.

No official patch or fix is available since this is a malicious package rather than a vulnerability in legitimate software. The recommended mitigation is to avoid installing the extra-huggingface package, especially from untrusted sources. Users should verify package authenticity before installation and remove any instances of this package if found. Security teams should monitor for and block connections to the hardcoded malicious server IP 91.92.40.212. Since this is a malicious typosquat, educating users about typosquatting risks and verifying package names is critical.