Malicious code in astlsi (PyPI)

The astlsi PyPI package contains malicious code that, when executed, traverses the Android user storage directory (/storage/emulated/0/) to collect files with source and document extensions such as .py, .json, .txt, .html, and .php. These files are compressed into a zip archive and sent via an HTTP POST request to a remote endpoint at https://tapi.bale.ai/<bot-token>/sendDocument with a hardcoded Bale bot token and chat ID. The package's purported proxy latency check is a cover for this data exfiltration activity. This behavior classifies the package as an infostealer targeting Android devices.

The malicious code enables unauthorized exfiltration of potentially sensitive user files from Android devices where the package is executed. This can lead to data leakage, privacy violations, and potential further compromise depending on the nature of the stolen files. The hardcoded credentials and remote endpoint facilitate covert data theft without user consent.

No official patch or remediation is currently available for this malicious package. Users and developers should avoid installing or using the astlsi package version 0.1.0 from PyPI. Remove any installations of this package from affected environments. Monitor for and block network communications to the indicated remote endpoint if possible. Use trusted sources and verify package integrity before installation.