Malicious code in hijiko-pilaka (PyPI)

The hijiko-pilaka package (version 1.0.0) on PyPI contains malicious code that employs fake HTTP-downloaded dependencies to monitor and track download activity. This behavior is indicative of dependency confusion tactics, where a package masquerades as a legitimate pentesting or research tool but is primarily designed for tracking rather than functional use. There is no evidence of additional harmful payloads or exploitation in the wild.

The primary impact is privacy-related, as the package tracks download activity through fake dependencies. There is no indication of direct system compromise or data exfiltration beyond this tracking. No known exploits are reported in the wild.

Since this package is malicious and serves no legitimate purpose, the recommended mitigation is to avoid installing or using the hijiko-pilaka package version 1.0.0. No official patch or fix is available. Users should verify package authenticity before installation and rely on trusted sources.