The aseity PyPI package version 0.1.0 includes a malicious payload embedded as a base64 and zlib encoded blob in aseity/_shimdata.py, which is decoded and executed both during installation (setup.py) and import (aseity/__init__.py). The first stage performs environment checks to detect virtual machines and debuggers, then downloads a PNG file from a suspicious domain that contains a ZIP archive with a Python executable and a main script. This second stage is launched detached and hidden, passing a hardcoded UUID to the payload. The malware includes an obfuscated native extension infostealer that collects sensitive data and exfiltrates it to a command-and-control server whose address is dynamically retrieved from Polygon blockchain transaction history. The package uses steganography and obfuscation techniques to evade detection and maintain persistence.

This malicious package can compromise the security of any system where it is installed or imported by executing arbitrary code, deploying a persistent second-stage implant, and stealing sensitive information. The infostealer component exfiltrates data to an attacker-controlled server, potentially leading to data breaches and further compromise. The use of sandbox and VM detection techniques may hinder analysis and detection by security tools.

No official patch or remediation is currently available. Users and organizations should avoid installing or importing the aseity package version 0.1.0 from PyPI. Remove any existing installations of this package and conduct forensic analysis on affected systems to detect and remediate the second-stage payload. Monitor for suspicious network activity related to the described domain and blockchain-based command-and-control communications. Check vendor advisories or PyPI security notices for updates on remediation.