The python-devplatform-client PyPI package is part of a malicious campaign that delivers and executes harmful code on affected systems. It attempts to download a malicious executable first from Cloudflare Workers, and if unsuccessful, reconstructs it from DNS TXT records across multiple domains. The malicious binary is executed and then deleted to avoid detection. Persistence is maintained through a PTH file that triggers execution on every Python startup. The package also overrides the setup.py install command to run malicious code during installation. This campaign exfiltrates basic system data such as IP address and username. The affected versions include 0.0.1 (which contains disarmed code initially), 8.5.3, and 8.5.4.

The malicious package can execute arbitrary code on the victim's system, potentially leading to unauthorized control. It exfiltrates basic system information like IP address and username, which could aid further attacks. The persistence mechanism ensures the malicious code runs on every Python start, increasing the risk of prolonged compromise. The package also attempts to evade detection by removing the downloaded executable after running it.

No official patch or remediation is currently documented for this malicious package. Users should immediately uninstall the python-devplatform-client package if installed. Avoid installing packages from untrusted sources or those with suspicious behavior. Monitor Python environments for unexpected PTH files or unusual network activity related to DNS TXT record queries. Since this is a malicious package on PyPI, report it to PyPI maintainers for removal. Patch status is not yet confirmed — check the vendor advisory or PyPI security notices for current remediation guidance.