The envprovision PyPI package versions 1.2.0, 1.3.0, and 1.4.0 include malicious functionality that, on Windows systems, fetches a JSON manifest from a base64-obfuscated URL and downloads a referenced binary without TLS verification, enabling on-path attackers to substitute the payload. This binary is executed silently with NSIS silent-install flags and spawns a detached persistence helper executable from user-writable locations. Post-execution, it clears Windows event logs to hinder forensic analysis. The installed executable is a heavily obfuscated malware known as Snow Stealer, which employs sandbox evasion techniques and steals sensitive data including browser information and cryptocurrency wallet data. The package's behavior is inconsistent with its advertised purpose, constituting a malicious installer-side binary dropper with persistence and data exfiltration capabilities.

The malicious envprovision package can lead to unauthorized code execution on Windows systems, persistence through a detached helper process, and anti-forensic activity by clearing event logs. The installed malware steals sensitive user data such as browser credentials and cryptocurrency wallet information, posing significant privacy and financial risks. The lack of TLS verification during download allows man-in-the-middle attackers to substitute malicious payloads, increasing exploitation risk.

No official patch or remediation is currently documented. Users should immediately uninstall the envprovision package versions 1.2.0, 1.3.0, and 1.4.0 and avoid installing it. Monitor for any presence of the dropped binaries or persistence helpers in user-writable ProgramFiles or LOCALAPPDATA directories on Windows. Since the package disables TLS verification, network-level protections to detect suspicious downloads from the obfuscated URL may help. Check vendor advisories or PyPI for updates or removal of the malicious package. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.