Malicious code in runpier (PyPI)

This threat involves the runpier package (version 0.1.0) on PyPI, which acts as a loader to execute code fetched from a remote URL. It is part of a broader campaign deploying multiple similar packages to facilitate remote code execution. The package does not embed malicious payloads directly but serves as a vector to load and run malicious scripts hosted elsewhere. The campaign is clearly malicious, aiming to provide deceptive methods to load harmful code remotely.

The impact arises from the package's capability to download and execute arbitrary remote scripts, which can lead to execution of malicious code on the user's system. This can result in compromise depending on the payload delivered by the remote script. The package itself does not contain the payload, but its use enables attackers to run arbitrary code remotely.

No official patch or remediation is indicated. Users should avoid installing or using the runpier package version 0.1.0. Since the package is malicious by design, the best mitigation is to remove it from environments and block its installation. Monitor PyPI for similar malicious packages and rely on trusted sources for package installation.