Malicious code in ig-gox (PyPI)

The ig-gox PyPI package (version 1.0.0) includes a top-level __init__.py that automatically executes a hidden payload when imported. This payload is obfuscated through base64 encoding, XOR decryption with a hardcoded key, zlib decompression, and HMAC verification before being executed. The package performs anti-analysis checks by detecting debuggers, decompilers, and sandbox indicators in the environment and exits if detected. It also tampers with built-in Python functions to hinder analysis. The remote code it downloads is used to abuse Instagram's API for mass fake account creation, indicating clear malicious intent.

This package enables remote code execution on systems that install and import it, potentially allowing attackers to abuse Instagram services for fraudulent activities such as mass fake account registration. The anti-analysis measures make detection and investigation difficult, increasing the risk of undetected malicious activity on affected systems.

No official patch or remediation is currently available. Users should avoid installing or importing the ig-gox package version 1.0.0. Remove the package from any environments where it is installed. Monitor for any suspicious activity related to Instagram API abuse. Patch status is not yet confirmed — check the vendor advisory or PyPI security notices for updates.