Malicious code in larchworker (PyPI)

This threat involves the larchworker package (version 0.1.0) on PyPI, identified as part of a coordinated campaign deploying multiple loader packages designed to execute code fetched from remote URLs. The package does not embed the malicious payload directly but acts as a loader to download and run malicious scripts remotely. This behavior is consistent with a campaign aimed at delivering malicious code, such as infostealers, through deceptive means.

The package enables execution of remote malicious scripts, which can lead to compromise of systems where it is installed. This can result in unauthorized code execution, potential data theft, or further malware deployment. The exact impact depends on the payload delivered by the remote script, but the presence of such a loader poses a significant security risk.

Users should avoid installing the larchworker package version 0.1.0 from PyPI. Since no patch or remediation is indicated, the best mitigation is to remove or not use this package. Monitor for any dependencies that may pull in this package and block or audit accordingly.