Malicious code in envprovision (PyPI)

The envprovision package (versions 1.2.0, 1.3.0, and 1.4.0) on PyPI contains malicious functionality that, on Windows systems, fetches a JSON manifest from a base64-obfuscated URL and downloads a referenced binary without TLS verification, allowing potential interception and substitution by attackers. The binary is executed silently with flags to avoid user detection and spawns a detached persistence helper executable. Post-installation, the malware clears Windows event logs to cover its tracks. The installed malware, identified as "Snow Stealer," is heavily obfuscated, employs sandbox evasion techniques, and functions as an infostealer targeting browser data and cryptowallet applications.

This malicious package enables remote code execution on Windows systems by downloading and executing an attacker-controlled binary. The malware establishes persistence, evades detection through sandbox checks and log clearing, and steals sensitive information including browser data and cryptocurrency wallet information. This can lead to significant data theft and compromise of user credentials and assets.

No official patch or remediation is currently documented. Users should immediately uninstall the envprovision package versions 1.2.0, 1.3.0, and 1.4.0. Avoid using this package from PyPI and monitor for any suspicious activity on affected systems. Since the package disables TLS verification during downloads, network-level protections such as blocking access to the malicious domain or using endpoint protection solutions may help mitigate risk. Check vendor advisories or PyPI for updates or removal notices.