The 'donutpromotion' PyPI package (version 0.1.0) executes arbitrary code during installation by fetching a JSON manifest from a hardcoded non-publisher domain or using a fallback encrypted payload embedded in the package. The payload is decrypted using ChaCha20+HMAC with a hardcoded passphrase and executed via exec(), granting the attacker code execution on the installer's machine. The malicious code only activates if user Documents or Downloads directories exist and avoids execution in sandbox or build farm environments by checking environment variables. Additionally, obfuscated code fetches a Python application with a native extension that acts as an infostealer, collecting sensitive data and exfiltrating it to a command-and-control server whose address is derived from Polygon blockchain transaction history. The package uses obfuscation, steganography, and sandbox evasion techniques, and its README misleads users about its functionality.

Successful installation of this package results in arbitrary code execution on the installer's machine, potentially compromising the system. The embedded infostealer can collect sensitive information and exfiltrate it to a remote attacker-controlled server, leading to data theft. The malware's sandbox evasion techniques increase the risk of undetected compromise on developer workstations.

No official patch or remediation is indicated. Users should avoid installing the 'donutpromotion' package version 0.1.0 from PyPI. Security teams should block or monitor for this package in their environments and educate developers about the risks of installing untrusted packages. Since the package uses sandbox evasion, dynamic analysis may be insufficient; manual code review or static analysis is recommended.