Malicious code in proxycer (PyPI)

The 'proxycer' PyPI package version 0.1.0 includes a top-level __init__.py that imports a 'starts.py' loader. This loader reverses a large string literal, base64-decodes it, then uses marshal.loads to convert it into a code object which is executed immediately. This obfuscation conceals the actual malicious payload, which collects and exfiltrates basic user system information such as IP address and username. The package lacks documentation and uses confusing naming to potentially trick users into installing it unintentionally (typosquatting). The package is categorized as probably low-harm, resembling pentest or research tools but with malicious intent.

Upon installation and import of 'proxycer' version 0.1.0, the obfuscated code runs automatically, potentially exfiltrating basic system information such as IP address and username without user consent or visibility. This can lead to privacy violations and unauthorized data disclosure. The risk is limited to information gathering; no further exploitation or system compromise is documented.

No official patch or remediation is currently documented. Users should avoid installing 'proxycer' version 0.1.0 from PyPI. Remove the package if already installed. Monitor package sources carefully to avoid typosquatting and malicious packages. Since the package executes code on import, do not import untrusted packages. Patch status is not yet confirmed — check the vendor advisory or PyPI security notices for updates.