The tinkoff-cloud-apis-internal package on PyPI contains malicious functionality that downloads and runs executables from remote sources, using a primary method via Cloudflare Workers and a fallback method that reconstructs the executable from DNS TXT records. The malicious code ensures persistence by placing a Python .pth file that executes on every Python interpreter start. It also exfiltrates basic system information and attempts to cover its tracks by deleting the downloaded executable after running it. The package overrides the setup.py install command to run malicious code during installation. Versions 0.0.1 (which initially contained disarmed code), 8.5.3, and 8.5.4 are affected. This is part of a known malicious campaign identified as 2026-07-andreiiiiiii_i and continues prior activity from 2026-07-haproxy-config-client.

The malicious package can execute arbitrary code on the affected system by downloading and running remote executables, potentially leading to system compromise. It also exfiltrates basic system information such as IP address and username, which could aid further attacks or profiling. Persistence mechanisms ensure the malicious code runs on every Python start, increasing the risk of ongoing compromise. The package also attempts to evade detection by removing the downloaded executable after execution.

No official patch or remediation guidance is provided in the available data. Users should immediately remove any installations of tinkoff-cloud-apis-internal versions 0.0.1, 8.5.3, and 8.5.4 from their environments. Avoid installing or using this package from PyPI. Monitor Python environments for unexpected .pth files that could indicate persistence mechanisms. Patch status is not yet confirmed — check the vendor advisory or PyPI security notices for current remediation guidance.