Malicious code in env-validator-tool (PyPI)

The env-validator-tool package on PyPI is a malicious package that does not contain any source code itself but declares a console script entrypoint referencing a non-existent module and an unpinned dependency on telemetry-helper. The telemetry-helper package contains malicious code that exfiltrates environment variables upon import. The env-validator-tool package acts as a lure to pull in telemetry-helper as a dependency, causing the malicious payload to execute on the installer's machine during installation. This campaign is identified as MALICIOUS with clear intent to steal environment variables.

Installing env-validator-tool versions 1.0.0, 1.0.1, or 1.0.2 results in the installation and execution of telemetry-helper, which exfiltrates environment variables from the victim's environment. This can lead to leakage of sensitive configuration and credential information stored in environment variables, potentially compromising security and privacy.

No official patch or remediation is indicated. Users should avoid installing env-validator-tool versions 1.0.0, 1.0.1, and 1.0.2 from PyPI. Review dependency chains carefully to detect and block malicious packages like telemetry-helper. Use trusted package sources and consider implementing package integrity verification and dependency auditing to prevent installation of malicious packages.