Malicious code in sysdiagd (PyPI)

The sysdiagd package versions 1.2.1, 1.2.2, and 1.2.3 on PyPI contain malicious code masquerading as a system monitoring tool. Instead of legitimate functionality, it operates as a Discord bot designed to steal sensitive information such as credentials, browser data, and files, while also capturing audio, screenshots, and video. The code requires the attacker to provide Discord bot credentials to activate its infostealer capabilities. This package is part of a campaign identified as 2026-10-sysdiagd, characterized by remote access trojan (RAT) behavior, data exfiltration, persistence, and spyware-like actions.

If installed and activated with the required bot credentials, the malicious sysdiagd package can lead to significant data theft including user credentials, browser data, and files. It can also capture audio, screenshots, and video, compromising user privacy and security. This can result in unauthorized access, data leakage, and potential further compromise of affected systems.

No official patch or remediation is indicated for this malicious package. The primary mitigation is to avoid installing the sysdiagd package versions 1.2.1, 1.2.2, and 1.2.3 from PyPI. Users should verify the authenticity of packages before installation and remove any instances of this package if found. Since the malicious functionality requires bot credentials to operate, ensuring that such credentials are not provided or are revoked can prevent activation.