The fast-hashes PyPI package version 0.1.0 includes a malicious setup.py script that overrides the installation process. It decodes a base64 payload that downloads an opaque binary from an unrelated GitHub account, saves it to /tmp, sets executable permissions, and launches it detached from the install process. The package itself only wraps hashlib functionality and has no legitimate need for native binaries, indicating the download-and-execute behavior is malicious. This results in arbitrary code execution under the installer's user context and data exfiltration, including cryptocurrency wallet information. The package is a typosquatting campaign designed to trick users into installing it.

Installation of fast-hashes version 0.1.0 results in arbitrary code execution on the host system with the privileges of the installing user. The malicious payload downloads and executes an unverified binary from a third-party GitHub repository, which exfiltrates cryptocurrency wallet data and possibly other sensitive information. This compromises the confidentiality and integrity of the affected system and user data.

Avoid installing the fast-hashes package version 0.1.0 from PyPI. Since this is a malicious typosquatting package, users should verify package names carefully before installation. There is no official patch or fix because this is a malicious package, not a legitimate software vulnerability. Remove any installations of this package and scan affected systems for indicators of compromise. Use trusted sources and verify package authenticity before installation.