The procwire PyPI package is part of a malicious campaign involving multiple packages. It overrides the setup.py install command to execute malicious code that downloads and runs a remote executable. This executable likely functions as an infostealer and communicates with the domain 030502[.]xyz. The malware uses obfuscation techniques including steganography in a bundled image and encoded byte arrays decoded by a custom method in a dependency. Additionally, procwire is a dependency of confighub, thereby extending the infection chain. The campaign is identified as MAL-2026-6750 and targets specific procwire versions.

The malicious code executes during package installation, leading to the download and execution of a remote infostealer executable. This compromises the host system by potentially stealing sensitive information. The infection can propagate through dependencies, affecting other packages that rely on procwire. The obfuscation and steganography techniques hinder detection and analysis.

No official patch or remediation is currently documented for procwire. Users should immediately avoid installing or using procwire versions 5.2.3, 5.2.5, 5.2.6, and 5.2.7. Audit and remove any installations of these versions. Monitor dependency chains for confighub or other packages depending on procwire and treat them as potentially compromised. Check vendor advisories or PyPI security notices for updates or removal of the malicious packages.