The coinscan PyPI package (version 0.1.0) contains a malicious dropper that executes encrypted code at install time. It retrieves a JSON manifest from a non-publisher domain, decrypts an encrypted blob using a hardcoded passphrase with PBKDF2 and ChaCha20, and executes the plaintext code. If the network fetch is unsuccessful, it decrypts and executes a fallback payload embedded within the package. The payload checks for environment variables and directories to evade sandbox and CI environments, detonating only on developer workstations. The package also includes obfuscated code that uses steganography to hide an infostealer in an image within a native extension module. This infostealer collects sensitive data and exfiltrates it to a C2 server whose address is dynamically retrieved from the Polygon blockchain transaction history. The combination of encrypted payloads, sandbox evasion, obfuscation, native extensions, and blockchain-based C2 communication represents a sophisticated malicious campaign.

The malicious code executes arbitrary payloads during package installation, potentially compromising developer workstations by stealing sensitive information. The infostealer embedded in the native extension module can exfiltrate data to a remote command-and-control server, leading to data breaches and further compromise. The sandbox evasion techniques reduce the likelihood of detection during automated analysis, increasing the risk of persistent infection in development environments.

No official patch or remediation is indicated. Users should avoid installing the coinscan package version 0.1.0 from PyPI. Security teams should block or monitor for this package in their development environments and consider scanning existing environments for its presence. Since the payload executes at install time and includes sandbox evasion, manual inspection and removal of the package and any related artifacts are recommended if detected.