Malicious code in python-walletlibr-v (PyPI)

python-walletlibr-v is a malicious PyPI package that pretends to be a wallet library but only includes a stub function and placeholder metadata. Its setup.py script registers a CustomInstall command that, when installed on Windows, writes a batch file to the temporary directory, spawns a new command console to execute this batch file, and runs the Windows calculator application via os.system. This results in arbitrary local command execution during the pip install process on Windows hosts without any user interaction beyond installation.

The package enables arbitrary local command execution on Windows systems during installation, which could be leveraged by an attacker to execute malicious commands or payloads with the privileges of the user running pip. This can lead to compromise of the local system, data theft, or further malware deployment. The malicious behavior is triggered automatically during installation and is unrelated to any advertised functionality, making it a supply chain risk.

No official patch or fix is available for this malicious package. The recommended mitigation is to avoid installing python-walletlibr-v from PyPI or any untrusted sources. Users should verify package authenticity and prefer well-known, trusted packages. Security teams should monitor for installation attempts of this package and block or remove it from environments where it may have been installed.