Malicious code in pymaas (PyPI)

The pymaas package version 99.99.0 includes top-level code that runs immediately on import, invoking a function that harvests the entire process environment variables and the system hostname. This data is serialized and exfiltrated via an HTTP POST request to a non-publisher-controlled external domain (https://vuorblucjega.dssldrf.net/python-install-log/pymaas). The package's unusually high version number and description referencing dependency confusion suggest it is a malicious package deployed to capture sensitive environment credentials through dependency confusion attacks.

This malicious package can leak sensitive environment variables including CI tokens, cloud provider keys, registry authentication tokens, and database passwords to an attacker-controlled external server. This exposure can lead to credential compromise and unauthorized access to critical systems or services that rely on these credentials.

No official patch or remediation is currently available. Users should avoid installing or importing the pymaas package version 99.99.0. Verify package authenticity before use and monitor for suspicious packages in dependency trees. Consider using package allowlists and supply chain security tools to prevent dependency confusion attacks.