Malicious code in olympuslib (PyPI)

The olympuslib PyPI package version 99.99.0 includes a top-level __init__.py that executes a _canary() function on import. This function serializes the entire environment variables dictionary along with the hostname and package identifiers, then sends this data via an HTTP POST request to a hardcoded external URL (https://vuorblucjega.dssldrf.net/python-install-log/olympuslib). The exfiltrated data can include sensitive secrets present in the environment, such as CI tokens, cloud credentials, API keys, and database URLs. The package's high version number and beaconing behavior indicate it is designed for dependency confusion attacks, aiming to harvest secrets from internal or private package usage.

Sensitive environment variables and system information can be exfiltrated to an attacker-controlled server during package import. This can lead to credential leakage, unauthorized access to cloud resources, and compromise of internal systems if secrets are present in the environment. The malicious package masquerades as a legitimate dependency, increasing the risk of inadvertent installation in CI/CD pipelines or development environments.

No official patch or remediation is currently available for olympuslib version 99.99.0. Users should immediately remove this package if installed and audit their environments for potential secret exposure. Avoid installing packages from untrusted sources or with suspicious versioning. Employ dependency whitelisting and supply chain security measures to prevent dependency confusion attacks. Monitor for any updates from PyPI or the package maintainer regarding remediation.