kotoraka version 0.1.0 is a malicious PyPI package that, when imported, decodes base64-obfuscated paths to locate Monero wallet directories on Windows and Linux systems. It forcibly terminates running Monero-related processes to unlock wallet files, archives the wallet directory into a zip file, and exfiltrates this archive via the Telegram Bot API using hardcoded bot token and chat ID. The exfiltration occurs as a side effect of importing the package, with no user action required. The package's declared purpose as an HTTP speed-up library is a deception. This behavior classifies it as an infostealer targeting cryptocurrency wallets.

Users who import kotoraka version 0.1.0 risk immediate theft of their Monero cryptocurrency wallet files. This can lead to loss of funds if attackers access the wallet data. The attack requires no user interaction beyond importing the package, making it highly dangerous in environments where the package is included as a dependency or installed inadvertently.

No official patch or remediation is available for kotoraka version 0.1.0 as it is a malicious package rather than a software vulnerability. The recommended mitigation is to avoid installing or importing this package. Remove any instances of kotoraka 0.1.0 from your environment immediately. Verify dependencies and supply chain sources to prevent accidental inclusion of this malicious package. Monitor for any unauthorized access to cryptocurrency wallets and consider moving wallets to secure environments.