The 'flasq' package on PyPI uses a typosquatting name 'requestss' to trick developers mistyping 'requests'. Its setup.py overrides the install command to run a base64-encoded post-install hook that downloads a remote executable from a personal GitHub repository without any integrity verification. This executable is saved to /tmp, permissioned to be executable, and launched detached. The malicious payload exfiltrates cryptocurrency wallet data and likely other sensitive information. The package's behavior is obfuscated and unrelated to its advertised purpose, indicating clear malicious intent.

Installation of the affected 'flasq' package results in execution of a remote binary that can exfiltrate sensitive data, including cryptocurrency wallet information. This compromises the confidentiality of user data and potentially the security of affected systems. The malicious code runs with the privileges of the installing user and can operate undetected due to obfuscation and detached execution.

Users should avoid installing the 'flasq' package and verify package names carefully to avoid typosquatting traps. Since no official patch or remediation is provided, the best mitigation is to remove any installations of the affected versions (=0.1.1, =0.1.2, =0.2.0, =0.3.0) and use the legitimate 'requests' package or other trusted alternatives. Monitor for any unexpected binaries in /tmp and network connections to suspicious domains such as the indicated GitHub repository. There is no vendor advisory or patch available; patch status is not yet confirmed — check PyPI and security advisories for updates.