The 'speed-hashes' PyPI package version 0.1.0 contains malicious code embedded in its setup.py file. Specifically, it defines a custom install command that, after the normal installation, decodes a base64 payload and executes it. This payload downloads a binary from a non-publisher GitHub account, saves it to /tmp, sets executable permissions, and runs it detached. The malicious executable is reported to exfiltrate cryptocurrency wallet data among other potential information. The package is a typosquatting attempt mimicking a popular library, aiming to trick users into installing it and thereby executing remote code on their systems.

Installation of this package leads to remote code execution on the host machine due to execution of attacker-controlled code during the install lifecycle. The malicious payload downloads and runs an external binary, which exfiltrates sensitive data such as cryptocurrency wallet information. This compromises the confidentiality and integrity of the affected system and user data.

No official patch or remediation is currently documented. Users should avoid installing the 'speed-hashes' package version 0.1.0 from PyPI. Verify package authenticity before installation, especially for packages with names similar to popular libraries. Use trusted sources and consider tools that detect typosquatting or malicious packages. Monitor vendor advisories or PyPI security notices for updates or removal of the malicious package.