Malicious code in jiklpo-tsunari-kay (PyPI)

The 'jiklpo-tsunari-kay' package on PyPI (version 1.0.0) employs fake HTTP-downloaded dependencies to monitor download activity. This behavior is indicative of a malicious package designed primarily for tracking rather than providing functional software. The package is associated with a dependency confusion campaign identified as '2026-10-vacsdk'. There is no evidence of exploitation in the wild or additional harmful payloads beyond the tracking mechanism.

The primary impact is the unauthorized tracking of download activity through fake dependencies. There is no indication of further malicious actions such as code execution or data exfiltration. The package does not appear to provide any legitimate functionality and may pose a risk if inadvertently included in software projects due to dependency confusion.

No official patch or remediation is available. Users should avoid installing or using the 'jiklpo-tsunari-kay' package version 1.0.0. Review dependency sources carefully to prevent dependency confusion attacks. Implement controls to verify package authenticity and integrity when managing dependencies.