Malicious code in houdus (PyPI)

The houdus package on PyPI (versions 1.0.0 and 1.0.1) includes a .wav file containing Python source code that is loaded and executed dynamically. This code performs multiple anti-analysis checks including VM and sandbox detection, RAM checks, and delayed execution. Upon passing these checks on non-sandbox Windows hosts, it silently installs pycryptodome, downloads a heavily obfuscated remote script (wobble.py) to a Start Menu Programs directory disguised with a .wav extension, and executes it via pythonw.exe without a window. The remote code further avoids sandbox detection, establishes persistence via scheduled tasks, and executes shellcode. This behavior is unrelated to the package's advertised random number generation functionality and is clearly malicious.

The malicious code enables stealthy remote code execution on Windows hosts, evades sandbox and VM detection, establishes persistence via scheduled tasks, and executes shellcode, potentially allowing attackers to maintain long-term control of affected systems. The package self-deletes after infection to avoid detection. This compromises system integrity and confidentiality.

No official patch or remediation is currently documented. Users should immediately uninstall the houdus package versions 1.0.0 and 1.0.1 and avoid using this package. Since the package is malicious by design, removing it from environments and blocking its installation is recommended. Monitor for any persistence mechanisms such as scheduled tasks and remove any suspicious files placed in Start Menu Programs directories. Patch status is not yet confirmed — check the vendor or PyPI advisory for current remediation guidance.