During installation, the donutautosellsrc package fetches code hidden within an image containing a Python application with a native extension module. This native module is obfuscated and functions as an infostealer, collecting sensitive information from the infected system. It exfiltrates the stolen data to a command and control server whose address is dynamically retrieved from transaction history on the Polygon blockchain. The campaign associated with this package demonstrates clear malicious intent, including downloading and executing remote executables, use of steganography, obfuscation, and native code to evade detection.

Sensitive data on systems where affected versions of donutautosellsrc are installed can be stolen and sent to a remote attacker-controlled server. This compromises confidentiality and potentially enables further attacks or data misuse. The use of obfuscation and blockchain-based C2 retrieval complicates detection and mitigation.

No official patch or remediation is indicated. Users should immediately uninstall affected versions (=0.3.7, =0.3.8, =0.3.9) of donutautosellsrc and avoid installing this package. Monitor for any unauthorized data exfiltration and consider forensic analysis if the package was installed. Since no vendor advisory or patch is provided, patch status is not yet confirmed — check the vendor advisory or PyPI security notices for updates.