The 'defi-kit' package version 2.1.1 includes a malicious module '_compat.py' that executes a 'check()' function spawning a daemon thread to harvest a wide range of sensitive credentials and configuration files from the host environment. The harvested data includes SSH keys, AWS credentials, Google Cloud JSON files, Kubernetes service account tokens, Docker and npm configuration files, git credentials, GnuPG private keys, Ethereum keystore files, shell histories, and environment files within user directories. This data is archived, base64-encoded, and exfiltrated via HTTP POST requests to two hardcoded IPv4 addresses on port 8877. The naming of variables and functions attempts to disguise the malicious activity as telemetry or compatibility checks.

Sensitive credentials and environment information from the host system are exfiltrated to attacker-controlled servers, potentially enabling unauthorized access to cloud services, source code repositories, cryptographic keys, and other critical resources. This compromises the confidentiality and integrity of the affected host and any connected infrastructure relying on these credentials.

No official patch or remediation is currently available for this malicious package version. Users should immediately remove 'defi-kit' version 2.1.1 from their environments and avoid installing or importing this package. Verify that no sensitive credentials have been compromised and rotate any potentially exposed keys or tokens. Monitor for any unauthorized access resulting from this compromise. Check the PyPI repository and vendor advisories for updates or removal of the malicious package.