Malicious code in sitecard (PyPI)

The 'sitecard' package on PyPI provides functionality to create SSH sessions exposed through tunnels. However, the package contains malicious code that by default allows the created SSH session to be accessed without any authentication. Additionally, the session details are reported to a hardcoded remote location, enabling attackers to gain unauthorized access to affected systems. This behavior classifies the package as a backdoor with clear malicious intent.

Users installing or using affected versions of the 'sitecard' package risk unauthorized remote access to their systems due to the unauthenticated SSH session. This can lead to compromise of system confidentiality, integrity, and availability. The hardcoded reporting mechanism further facilitates attacker control and monitoring of compromised systems.

No official patch or remediation is currently documented. Users should immediately discontinue use of the 'sitecard' package versions 0.1.0 through 0.1.14. Verify that no unauthorized SSH tunnels or sessions exist on systems where this package was installed. Monitor for suspicious network connections to unknown external hosts. Consider removing the package and replacing it with trusted alternatives. Check for updates from the package maintainers or PyPI advisories for any future remediation.