The openblox package on PyPI, specifically versions 1.0.0 and 1.0.1, includes a malicious setup.py script that unconditionally executes a function at install time. This function reconstructs obfuscated strings to form a command invoking the Windows mshta.exe utility to fetch and run a remote HTA/JScript payload from https://fixars.top. This results in arbitrary code execution on the installer's machine. The obfuscation uses character arithmetic to hide the URL and command from static analysis. The package also uses misleading metadata and a Roblox-themed name to attract users intending to install a legitimate library, effectively acting as a trojanized package.

Installing the affected versions of the openblox package leads to arbitrary code execution on the victim's Windows machine via mshta.exe executing a remote script. This can allow an attacker to run any code with the privileges of the user performing the installation, potentially leading to full system compromise or further malware deployment.

No official patch or remediation is currently documented. Users should avoid installing the openblox package versions 1.0.0 and 1.0.1 from PyPI. Verify package authenticity before installation and consider using trusted package sources or mirrors. Monitor for updates from the package maintainer or PyPI for any official fixes or removals.