The pyjstat-smooth package includes hidden code that exfiltrates files from infected systems. The targeted file paths indicate a focus on environments similar to CTF challenges. The package uses obfuscation techniques and impersonates a legitimate package to evade detection. This campaign is categorized as malicious with intent to steal data, but there is no indication of active exploitation in the wild or a CVSS score.

The malicious code can lead to unauthorized data exfiltration from affected systems, potentially compromising sensitive information. The targeted nature of the file paths suggests a focused attack scenario rather than broad indiscriminate infection. There is no evidence of widespread exploitation currently.

No official patch or remediation is provided. Users should immediately uninstall the pyjstat-smooth package versions listed as affected and avoid installing packages from untrusted sources. Verify package authenticity before installation, especially for packages that clone legitimate ones. Monitor for suspicious network activity related to file exfiltration.