fastapii is a malicious PyPI package that uses typosquatting to impersonate the legitimate fastapi package. Its setup.py overrides the install command to run a post-install step that decodes a base64 payload and executes it. On Linux, this payload downloads a binary from an unrelated GitHub repository, saves it to /tmp, makes it executable, and launches it detached. The binary is unverified and unpinned, posing a risk of arbitrary code execution. The package itself contains only a stub module with trivial functionality to obscure its malicious intent. The payload is designed to exfiltrate cryptocurrency wallet data and possibly other sensitive information. This threat is Linux-specific and activates during installation or in Linux CI/production environments.

The malicious package can lead to arbitrary code execution on Linux systems during installation. The downloaded binary can exfiltrate cryptocurrency wallet data and potentially other sensitive information. This compromises the confidentiality and integrity of affected systems and data. Because the payload is executed during installation, it can affect developer environments, CI pipelines, and production Linux servers that inadvertently install this package. The unverified remote fetch increases the risk of supply chain compromise and further malware delivery.

Avoid installing the fastapii package or any similarly named typosquatting packages. Use only the official fastapi package from PyPI. Since no official patch or remediation exists for the malicious fastapii package itself, remediation involves removing any installed instances of fastapii and scanning affected systems for the downloaded payload and signs of compromise. Verify package names carefully before installation and consider using package allowlists or automated supply chain security tools to prevent typosquatting attacks.