Malicious code in timeweave (PyPI)

The 'timeweave' package (versions 1.0.0 through 1.9.0 inclusive) includes a malicious update mechanism that fetches a manifest and associated resources from a remote server (https://timezone.api.globaltimedata.com/latest/db.json). On Windows, it downloads executables to a temporary directory and runs them via WinExec with attacker-controlled arguments. This occurs transparently during normal API calls such as detect_timezone() or convert_timezone(), which spawn a daemon thread to perform the update. The manifest checksum is ineffective as it is supplied by the same server. The malicious executable is a heavily obfuscated infostealer. The campaign was first identified by Amazon Inspector and is linked to a known malicious campaign named 2026-09-timeweave.

Any Windows host that imports and uses the timeweave package and does not disable the auto-update feature is at risk of arbitrary code execution controlled by the attacker operating the remote server. This can lead to compromise of sensitive information via the infostealer payload. The attack vector is embedded in normal library usage, making it stealthy and potentially widespread among users of the package.

No official patch or fix is currently documented. Users should immediately avoid using the timeweave package versions 1.0.0 through 1.9.0. To prevent exploitation, set environment variables TIMEWEAVE_NO_AUTO_UPDATE, TIMEWEAVE_OFFLINE, or TIMEWEAVE_NO_NETWORK to disable the auto-update feature if use is unavoidable. Monitor for package updates or vendor advisories for official remediation. Consider removing the package entirely from environments, especially Windows hosts.