Malicious code in marshrunner (PyPI)

The marshrunner package (version 0.1.0) is involved in a campaign distributing loader packages that execute code fetched from remote URLs. These packages do not embed the malicious payload directly but serve as delivery mechanisms for remote malicious scripts. The campaign is coordinated and aims to provide multiple deceptive methods to load malicious code, with an intent consistent with infostealing malware.

Users installing or running marshrunner version 0.1.0 risk executing remote malicious scripts, which could lead to unauthorized code execution and potential data theft or system compromise. The package acts as a loader, enabling attackers to deliver and execute arbitrary malicious payloads from external sources.

No official patch or remediation is indicated. Users should avoid installing or using marshrunner version 0.1.0. Review and remove any installations of this package and monitor for any suspicious activity related to its use. Since this is a PyPI package, consider using trusted package sources and verifying package integrity before installation.