This threat involves a malicious PyPI package named yt-api-dlp, specifically versions 0.1.0 and 0.1.1. The package acts as a trojanized clone of a legitimate package. When imported, it downloads an encrypted archive disguised as an image file. This archive contains a next-stage script that leverages the Polygon blockchain smart contract (0xC7c9026a3a7e27ec6Ce2D09B19FC1FB4bc978BBb) to obtain the C2 server address. The malware establishes an encrypted communication channel with the C2 to receive commands and maintain persistence. The C2 server sends an executable payload that is injected into another process's memory for execution. Test data in the payload suggests the author is developing botnet capabilities. The package was briefly used as a dependency in a GitHub project, increasing exposure risk.

The malicious package can lead to remote code execution on systems that import it, enabling attackers to establish persistent control. The use of blockchain to retrieve C2 addresses complicates detection and takedown. The delivered payload runs in memory, potentially evading traditional file-based detection. The overall impact includes unauthorized system compromise, potential data theft, and use of infected systems in a botnet.

No official patch or fix is available since this is a malicious package impersonating a legitimate one. The best mitigation is to avoid installing or using yt-api-dlp versions 0.1.0 and 0.1.1 from PyPI. Remove any installations of this package immediately. Verify dependencies in projects to ensure no indirect inclusion of this malicious package. Monitor supply chain dependencies carefully to prevent inclusion of trojanized packages.