The platform-telemetry-client PyPI package version 1.0.0 includes a malicious .pth file that triggers code execution on each Python startup. This loader fetches a subsequent payload fragmented across DNS records, employing data storage in DNS to evade detection. The campaign associated with this package, 2026-09-platform-telemetry-client, is identified as malicious, leveraging obfuscation and abuse of Python's .pth mechanism. The intended domain for payload retrieval was unregistered during analysis, suggesting the attack infrastructure was not fully operational at that time.

If executed, this malicious package can run unauthorized code on the victim's system every time Python initializes, potentially leading to information theft or further compromise via payloads retrieved through DNS queries. The use of DNS for payload storage complicates detection and blocking efforts. However, no active exploitation in the wild has been reported, and the payload domain was not registered at the time of analysis.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing or using the platform-telemetry-client package version 1.0.0 from PyPI. Security teams should block or monitor for this package in their software supply chain and repositories. Since this is a malicious package rather than a vulnerability in legitimate software, removal and prevention of installation are the primary defenses.