Malicious code in qoeoe (PyPI)

The 'qoeoe' PyPI package version 0.1.0 includes a single module whose entire code is a lambda function that base64-decodes a reversed large string and executes it with exec(), resulting in immediate execution of an opaque ~80 KB payload upon import. The package lacks documentation or legitimate functionality, and analysis shows it exfiltrates files to a remote server. This import-time execution of attacker-controlled code represents a malicious package designed to compromise systems that install or import it.

Any system that installs and imports the 'qoeoe' package version 0.1.0 will execute arbitrary attacker-controlled code, leading to potential data exfiltration and compromise of the host environment. The malicious payload runs immediately on import, enabling stealthy and automatic execution without user interaction beyond importing the package.

No official patch or remediation is currently available. Users and organizations should avoid installing or importing the 'qoeoe' package version 0.1.0. Review and remove any instances of this package from environments. Monitor package sources and supply chains to prevent accidental inclusion of this malicious package.