The 'idnna' package on PyPI mimics the name of the legitimate 'idna' package and advertises itself as HTTP client utilities, but contains only a trivial module. Its setup.py overrides the install command to execute a base64-decoded hidden payload. This payload downloads an opaque binary named 'something' from a personal GitHub repository unrelated to the package's stated purpose, sets executable permissions, and runs it detached. The downloaded artifact is unpinned by hash, and the payload is obfuscated to evade detection. The executed binary reportedly exfiltrates cryptocurrency wallet data and possibly other sensitive information. This malicious code activates automatically during the installation of versions 0.1.1, 0.1.2, 0.2.0, and 0.3.0.

Installation of the 'idnna' package results in execution of a remote, unverified binary that can exfiltrate sensitive data such as cryptocurrency wallet information. This compromises the confidentiality of user data and may lead to financial loss or further system compromise. The attack is triggered automatically during package installation, increasing risk of inadvertent infection.

Users should avoid installing the 'idnna' package and verify package names carefully to avoid typosquatting. Remove any installed versions of 'idnna' (0.1.1, 0.1.2, 0.2.0, 0.3.0) from environments. Since no official patch or fix exists, the best mitigation is to rely on trusted sources and package names. Monitor for suspicious activity if the package was installed. There is no vendor advisory or patch available; patch status is not yet confirmed — check vendor advisories or PyPI security notices for updates.