The sqligen PyPI package versions 1.0.0, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.1.1, 1.1.3, and 1.1.4 contain malicious code that, upon installation, attempts to download and execute a remote malicious executable. This activity is part of a known malicious campaign (2026-06-easyaillm) characterized by obfuscation and the use of mshta to run malware. The package is identified as a supply chain threat due to its presence on PyPI and the execution of unauthorized code during installation.

Systems installing any of the affected sqligen package versions risk executing remote malicious code, potentially leading to system compromise, data theft, or further malware infection. The malicious executable is downloaded and started without user consent, representing a direct execution of malware through the supply chain.

No official patch or remediation is currently documented. Users should avoid installing the affected sqligen package versions listed. Verify package integrity and source before installation. Consider removing any installations of these versions and monitor for suspicious activity related to mshta or unexpected remote executable downloads. Patch status is not yet confirmed — check the vendor advisory or PyPI security notices for updates.