Malicious code in hijok-lampam (PyPI)

The hijok-lampam PyPI package version 1.0.0 contains malicious code that uses fake HTTP-downloaded dependencies to monitor download activity. This behavior is characteristic of dependency confusion attacks, where attackers publish packages mimicking legitimate dependencies to capture data or disrupt development processes. The package does not provide any functional utility beyond this tracking mechanism. No CVSS score or detailed technical exploit information is available.

The primary impact is unauthorized tracking of download activity through fake dependencies, which may lead to privacy concerns or indirect reconnaissance by attackers. There is no indication of direct code execution or system compromise from the provided data. No known exploits are reported in the wild.

Since no official patch or remediation is indicated, the best mitigation is to avoid using the hijok-lampam package version 1.0.0. Verify dependencies carefully to prevent dependency confusion attacks by ensuring packages are sourced from trusted repositories and use explicit versioning. Monitor for updates or advisories from PyPI or package maintainers.