The jsonschemavalid package version 4.26.0 is identified as a malicious clone containing obfuscated code that establishes a reverse shell connection. This backdoor enables remote command execution by attackers on systems where this package is installed. The reverse shell connects to a private IP address, suggesting limited or testing-stage deployment. This package impersonates a legitimate PyPI package, posing a supply chain risk. No CVSS score or vendor advisory is available, and no patch or fix has been indicated.

If installed, the malicious jsonschemavalid package allows attackers to gain remote control over the affected system via a reverse shell, potentially leading to full system compromise. The presence of a reverse shell can enable unauthorized command execution, data theft, or further malware deployment. Since this is a supply chain attack vector, any environment that installs this package version is at risk.

No official patch or remediation is currently available. Users should immediately uninstall version 4.26.0 of jsonschemavalid and avoid installing this package. Verify package integrity by using trusted sources and checksums. Monitor for any unexpected network connections to private IP addresses originating from systems with this package. Consider using package allowlists and supply chain security tools to prevent installation of malicious clones.