Malicious code in syswatch (PyPI)

Importing syswatch version 1.0.0 on Windows triggers a background thread that fetches a JSON manifest from a Railway-hosted lookalike domain, downloads an executable referenced by the manifest, and runs it silently with NSIS-style flags. TLS verification is disabled for these network operations. The malware launches a helper executable and clears Windows Application and System event logs to evade detection. The installed payload is a heavily obfuscated infostealer called "Snow Stealer" that collects browser data and modifies cryptowallet applications. The package uses sandbox evasion techniques and hides its malicious actions within library usage, misleading users about its true intent.

The malware steals sensitive information including browser data and cryptocurrency wallet information, potentially leading to credential theft and financial loss. It also attempts to evade detection by disabling TLS verification, obfuscating its code, and clearing Windows event logs. The presence of persistence mechanisms and sandbox evasion increases the risk of prolonged undetected compromise on affected systems.

No official patch or remediation is currently available. Users should immediately uninstall syswatch version 1.0.0 from their environments. Avoid importing or using this package, especially on Windows systems. Monitor for and remove any instances of the downloaded malicious executable and related helper processes. Because the package disables TLS verification and erases logs, forensic investigation should consider alternative evidence sources. Check vendor or PyPI advisories for updates or removal of the malicious package.