Malicious code in pygame-renderkit (PyPI)

The pygame-renderkit PyPI package version 1.2.0 overrides the install command in setup.py to execute a hidden base64-encoded Python payload. This payload forks a daemonized child process that connects to a hardcoded C2 server (5uj0a8ziyu.localto.net:3900) and provides an interactive reverse shell by duplicating the socket onto the shell's stdin/stdout/stderr. It enumerates environment variables containing sensitive keywords (e.g., API, TOKEN, KEY, SECRET, PASS, CRED, AUTH, AWS, AZURE, GCP, OPENAI, ANTHROPIC, MANUS) and reads sensitive files such as /etc/passwd, /etc/sudoers, /etc/shadow, ~/.bash_history, and /opt/.manus/current/config. The collected data is exfiltrated over TCP framed by specific markers. Persistence is achieved by writing a Python script to /tmp, installing a per-minute cron job, deploying a systemd user service with automatic restart, and adding a sudoers.d entry granting passwordless sudo privileges to the current user. The malicious payload is disguised within a template with placeholders for host and port, and the installer hides its activity by forking with start_new_session=True. This package is clearly malicious and does not perform any legitimate pygame-related functions.

Successful installation of this package results in full remote command execution via a reverse shell, unauthorized exfiltration of sensitive environment variables and critical system files, and persistent backdoor access through cron jobs, systemd services, and elevated sudo privileges without password prompts. This compromises confidentiality, integrity, and availability of the affected system.

No official patch or remediation is currently documented. Users should avoid installing pygame-renderkit version 1.2.0 from PyPI. If installed, immediate removal of the package and investigation for persistence mechanisms (cron jobs, systemd user services, sudoers modifications) is required. Monitor for suspicious network connections to the indicated C2 domain. Patch status is not yet confirmed — check the vendor advisory or PyPI security notices for updates.