The 'aiosendletter' package on PyPI ships with a malicious module 'e.py' that prompts for UAC elevation, archives the contents of the %LOCALAPPDATA%\logs directory (which may contain Discord, browser, and game-tool session data), and exfiltrates this archive via HTTP POST to a hardcoded attacker-controlled endpoint. The package's description and identifiers are deceptive, framing it as a legitimate bug reporter. Furthermore, the package's pyproject.toml declares the Python standard library package 'ctypes' as an unpinned runtime dependency, allowing pip to resolve and install a potentially malicious package from PyPI during installation, representing a dependency confusion vector. Some releases explicitly target Telegram data for exfiltration. This behavior classifies the package as a malicious infostealer.

Users who install or run the affected versions of 'aiosendletter' risk unauthorized exfiltration of local log files that may contain sensitive session information from applications like Discord, browsers, game tools, and Telegram. The package also introduces a supply chain risk via dependency confusion by referencing an unpinned standard library package name, potentially executing arbitrary code during installation. This can lead to significant privacy breaches and compromise of user credentials or session tokens.

No official patch or remediation is currently documented. Users should immediately avoid installing or using the 'aiosendletter' package, especially the affected versions. Remove any installations of this package from systems. Monitor for and block network traffic to the known malicious endpoint. Verify dependencies carefully to avoid dependency confusion attacks, ensuring that standard library packages are not overridden by malicious PyPI packages. Check vendor advisories or PyPI security notices for updates or removal of the malicious package.