The airflow-provider-spirit PyPI package contains malicious code that installs a persistent telemetry component via a .pth file, causing it to auto-load on every Python interpreter start regardless of package import. This component collects system information such as hostname, OS details, architecture, Python version, CPU count, and a session ID. It uses raw UDP DNS queries to public resolvers to retrieve base64-encoded data from TXT records under attacker-controlled domains, dynamically resolving the beacon destination at runtime to evade blocklists. Additionally, it attempts to download and execute a remote binary from Cloudflare Workers or reconstructs it from DNS TXT records if the primary method fails. The malicious executable is run and then removed, ensuring persistence and covert data exfiltration. The package disguises this activity under the guise of anonymous telemetry and Airflow provider functionality. Affected versions include 0.0.1 (which contains disarmed code), 8.5.3, and 8.5.4.

This malicious package enables persistent execution on infected systems by auto-loading on every Python interpreter start. It collects and exfiltrates system information and can download and execute arbitrary remote binaries, potentially leading to further compromise. The use of DNS TXT records for command and control and payload delivery allows it to evade traditional network blocklists. The package also overrides the installation process to execute malicious code, increasing infection risk. Overall, it poses a significant threat to confidentiality and system integrity.

No official patch or remediation is currently documented for this malicious package. The best mitigation is to avoid installing airflow-provider-spirit from PyPI and remove it if present. Since the package uses a .pth file for persistence, manual removal of the package and any related .pth files from site-packages is necessary. Monitor for and block DNS queries to suspicious domains such as those under dl.well1.site and Cloudflare Workers used by this package. There are undocumented environment variables (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT) that may disable telemetry, but these are not publicly documented and may not fully mitigate the threat. Check vendor or PyPI advisories for updates.