The 'cryptgraphy' PyPI package is a typosquatting malicious package that mimics legitimate cryptography and AWS packages by using similar names and falsified author metadata. Its setup.py installs a custom command that, upon installation, writes a shell script to /tmp which sleeps for five minutes before downloading an ELF binary from a suspicious external URL. This binary is staged as /tmp/systemd-helper, made executable, and launched detached. The binary's behavior suggests attempts at persistence through systemd-like services, cryptocurrency mining, and network scanning or propagation. The Python module itself is a no-op stub, indicating the malicious payload is delivered solely via the installation process. The campaign is linked to similar previous campaigns and uses delayed execution and systemd-mimicking filenames as anti-forensic measures.

Installation of this package results in execution of a remote ELF binary that may establish persistence on the infected system, perform cryptocurrency mining, and scan or propagate over the network. The package's malicious behavior occurs during installation, potentially compromising the host system without user awareness. The use of typosquatting increases the risk of accidental installation by users expecting legitimate packages. There is no confirmed active exploitation in the wild reported yet.

No official patch or fix is available since this is a malicious package impersonating legitimate software. The primary mitigation is to avoid installing packages with suspicious or typosquatted names. Users and organizations should verify package authenticity before installation, prefer official package names, and use tools that detect typosquatting or malicious packages. Monitoring package sources and employing supply chain security measures can help prevent installation of such malicious packages.