Malicious code in brambletask (PyPI)

The brambletask package version 0.1.0 is involved in a campaign distributing loader packages designed to execute code fetched from remote URLs. These packages do not embed the malicious payload directly but serve as a mechanism to load and run malicious scripts remotely. The campaign is coordinated and aims to provide multiple deceptive methods for loading malicious code, with intent linked to infostealing activities.

Users installing or using brambletask version 0.1.0 risk executing remote malicious scripts, potentially leading to information theft or other malicious outcomes. The package acts as a loader, enabling attackers to run arbitrary code on affected systems.

No official patch or remediation is indicated. Users should avoid installing or using brambletask version 0.1.0. Since the package is malicious by design, removal and blocking of this package from environments is recommended. Monitor package sources and dependencies to prevent inclusion of such malicious loaders.