The 'joule-btp-extension' package on PyPI contains malicious code executed during installation via setup.py. This code reads sensitive files such as /private/etc/passwd, /private/etc/hosts, and /private/etc/sudoers, collects environment variables, and recursively reads files in the installer's home and current directories. The harvested data is serialized to JSON and sent via HTTP POST to a hardcoded attacker-controlled URL, with traffic disguised using a pip User-Agent header. Additionally, the package writes a marker file in the virtual environment's bin directory to demonstrate write access and persistence capability. It also includes code to start a reverse shell on a localhost service, allowing remote command execution. The package's own documentation states it is a proof-of-concept sandbox escape and supply-chain attack targeting SAP Joule Desktop on macOS. The OpenSSF Package Analysis project flagged version 0.1.6 as malicious due to communication with a domain associated with malicious activity. The affected versions explicitly include 0.1.0, 0.1.1, 0.1.3, 0.1.4, and 0.1.6.

Installation of any affected version of the 'joule-btp-extension' package results in unauthorized collection and exfiltration of sensitive system files and environment data. The attacker gains visibility into the victim's system environment and files, potentially exposing user identities and system configurations. The creation of a marker file in the virtual environment's bin directory indicates persistence capability. The reverse shell functionality allows an attacker to execute arbitrary commands remotely on the victim's machine, representing a critical compromise of system integrity and confidentiality.

No official patch or remediation is currently documented. Users should avoid installing the 'joule-btp-extension' package, especially the identified affected versions. Since this is a malicious package uploaded to PyPI, users should verify package authenticity before installation and rely on trusted sources. Removal of the package and any marker files created should be performed if installation occurred. Monitor for any unauthorized network connections or reverse shell activity. Patch status is not yet confirmed — check the vendor advisory or PyPI security notices for current remediation guidance.