Malicious code in queeuees (PyPI)

The 'queeuees' PyPI package version 0.0.1 includes two top-level packages, 'Queeuees' and 'Queues', each with identical obfuscated __init__.py files. These files assemble a byte payload through multiple transformations including bit-rotation, XOR keystream, seeded Fisher-Yates shuffle, inverse S-box, and LCG XOR stages. The decoded payload is executed at import time using builtins.exec, triggered by a descriptor __set_name__ hook during class definition. The code uses homoglyph-style identifiers and misleading labels to disguise its true purpose. The malicious payload iterates over system files and modifies every Python (.py) file by adding comments, thus altering the system without user consent. The package's name and metadata are designed to catch typos and mislead users about its functionality.

The malicious code executes automatically upon importing the package, leading to unauthorized modification of Python source files on the system. This behavior can compromise code integrity, potentially enabling further malicious activities or disrupting normal operations. The obfuscation and execution at import time increase the risk of unnoticed infection in development environments.

No official patch or remediation is currently available. Users should immediately uninstall the 'queeuees' package version 0.0.1 and avoid installing similarly named packages such as 'Queues'. Review and restore any modified Python files from trusted backups. Exercise caution with packages that have suspicious names or obfuscated code. Monitor PyPI for updates or vendor advisories regarding this package.