Malicious code in tonemaptts (PyPI)

The 'tonemaptts' package on PyPI, specifically version 0.1.0, is identified as malicious software that masquerades as a legitimate audio-analysis tool. Instead of providing the advertised functionality, it downloads and executes remote code, likely continuing a known coin-mining campaign. The malicious intent is clear, with the package serving as a vector for remote code execution. The remote URL is not embedded directly in the package, indicating a level of obfuscation or dynamic retrieval of the malicious payload.

Users who install the 'tonemaptts' package version 0.1.0 risk executing unauthorized remote code on their systems, which can lead to compromise including but not limited to unauthorized resource usage (e.g., coin mining), data theft, or further malware deployment. The package does not embed the malicious URL directly, complicating detection and increasing the risk of stealthy exploitation.

Avoid installing the 'tonemaptts' package version 0.1.0 from PyPI. If already installed, remove the package immediately. Since this is a malicious package rather than a vulnerability in legitimate software, no patch or official fix exists. Users should rely on trusted sources and verify package authenticity before installation. Monitor PyPI and security advisories for updates on this campaign.