The dde-common PyPI package masquerades as a utility library but contains malicious code that installs a telemetry.pth file into site-packages. This .pth file causes the _telemetry_init module to run on every Python interpreter start, spawning a background thread that collects host identifiers (hostname, OS, Python version, PID, cpu_count) and sends a 'session_start' event. The package uses DNS TXT record queries to 8.8.8.8 and 1.1.1.1 to dynamically reconstruct a base64-encoded C2 server endpoint, avoiding static URLs. If the initial download of a malicious executable from Cloudflare Workers fails, the package falls back to reconstructing the executable from multiple DNS TXT records across several domains, then executes and deletes the binary. The package overrides setup.py install commands to execute malicious code during installation, ensuring persistence and covert communication. Versions 0.0.1 contain disarmed code, with full malicious functionality in later versions 8.5.3 and 8.5.4.

This malicious package enables persistent, interpreter-wide execution of unauthorized code on affected hosts. It collects and exfiltrates host metadata and downloads and executes remote binaries, potentially leading to full system compromise. The use of DNS TXT records for covert C2 rendezvous and fallback download methods complicates detection and mitigation. The package abuses Python packaging mechanisms to maintain persistence and evade simple detection. There is no indication of known exploits in the wild yet, but the capability for remote code execution and covert communication represents a high risk.

No official patch or remediation is available since this is a malicious package rather than a vulnerability in legitimate software. The recommended mitigation is to remove the dde-common package from all environments and ensure no telemetry.pth or _telemetry_init modules remain in site-packages. Avoid installing packages from untrusted sources or with suspicious telemetry behavior. Monitor Python environments for unexpected .pth files and network DNS queries to unusual domains. Since this is not a cloud service, remediation is the responsibility of the user environment. Patch status is not applicable; check vendor or PyPI advisories for updates or takedown notices.