The darkglitch PyPI package versions 1.2.0 and 1.2.9 include a listener CLI that connects to a hardcoded WebSocket signaling host (malware-signal.vercel.app) and joins a fixed room (D4RKGLI7CH). It processes incoming 'remote-command' messages by executing them on the host via subprocess.run with shell access, returning output to the sender. The package also supports arbitrary file exfiltration and upload through base64-encoded payloads sent over this channel. Internal modules describe the package as a post-exploitation and advanced command and control framework. The shared room identifier allows any actor with knowledge of it to issue commands to all hosts running the listener, effectively enabling remote control and data theft.

Hosts running the affected darkglitch versions are subject to remote arbitrary command execution and file transfer by any attacker who knows the hardcoded signaling server and room identifier. This enables full remote control, data exfiltration, and potential further compromise of the affected system. The presence of this package on a system indicates a severe compromise risk.

No official patch or remediation is currently documented. Users should immediately uninstall the darkglitch package versions 1.2.0 and 1.2.9 if present. Avoid running unknown or untrusted PyPI packages. Monitor systems for presence of this package and related network connections to malware-signal.vercel.app. Patch status is not yet confirmed — check the vendor advisory or PyPI for updates. Given the malicious nature, removal and forensic investigation are recommended.