The multyproccess PyPI package versions 2.32.3, 2.32.4, 2.32.5, and 2.32.6 contain malicious code that executes during installation by overriding the install command in setup.py. This code performs infostealing activities such as exfiltrating browser and cryptocurrency wallet data, establishing persistence, and monitoring clipboard contents. It also detects sandbox environments to avoid analysis and uses obfuscation techniques. The package is a typosquatting clone of a legitimate package, designed to deceive users into installing it.

Successful installation of the affected multyproccess package versions leads to compromise of sensitive user data including browser credentials and cryptocurrency wallets. The malware establishes persistence on the host system and monitors clipboard data, potentially capturing additional sensitive information. The presence of sandbox detection and obfuscation complicates detection and analysis.

Users should avoid installing the affected versions of the multyproccess package (=2.32.3, =2.32.4, =2.32.5, =2.32.6). Remove any installations of these versions immediately. Verify package authenticity before installation, especially for packages with names similar to popular ones (typosquatting). Since no official patch or remediation is indicated, rely on vendor or PyPI advisories for updates. Employ endpoint security solutions to detect and remove persistence mechanisms and monitor for suspicious clipboard activity.