Malicious code in thistlerun (PyPI)

This threat involves the thistlerun PyPI package version 0.1.0, which acts as a loader to execute code fetched from a remote URL. It is part of a broader campaign deploying multiple similar packages designed to deceptively load malicious code. The packages do not embed the malicious payload directly but serve as vectors to download and run it, indicating a coordinated effort to distribute malware.

The impact is the potential execution of remote malicious scripts on systems that install and run the thistlerun package version 0.1.0. This could lead to compromise depending on the nature of the downloaded payload. No direct payload is included in the package itself, but the capability to execute arbitrary remote code poses a significant security risk.

No official patch or remediation is indicated. Users should avoid installing or using the thistlerun package version 0.1.0 from PyPI. Security teams should monitor for this package in their environments and block or remove it to prevent execution of remote malicious code.