Malicious code in fontcase (PyPI)

The fontcase package versions 0.1.0, 0.1.1, and 0.1.2 on PyPI is identified as malicious. Upon import, it downloads and executes a remote infostealer designed to exfiltrate sensitive data such as browser information and credentials. The campaign associated with this package uses a Telegram bot for command and control. This is not a vulnerability in the traditional sense but a malicious package designed to compromise user data.

Users who install and import the affected fontcase package versions risk having their browser data and credentials stolen by the infostealer. This can lead to unauthorized access to user accounts and potential further compromise of systems where the package is used.

Avoid installing or using the fontcase package versions 0.1.0, 0.1.1, and 0.1.2 from PyPI. There is no known patch or remediation available. Users should remove any installations of this package and verify that no malicious processes or data exfiltration have occurred. Use trusted sources and verify package integrity before installation.