The 'trongriden' package on PyPI, specifically version 0.0.1, is classified as a malicious package intended for private key exfiltration, likely targeting cryptocurrency users. The package is linked to a campaign named '2025-04-tronix' and is noted for cloning readme files from legitimate libraries to appear trustworthy. This campaign involves multiple similar packages being repeatedly uploaded to PyPI. No CVSS score or detailed technical exploit information is available, and no known active exploitation has been reported.

If installed, the malicious package could exfiltrate private keys, potentially compromising cryptocurrency wallets or other sensitive cryptographic assets. This poses a direct threat to confidentiality and asset security for users who unknowingly install this package. There are no reports of active exploitation in the wild.

Users should avoid installing the 'trongriden' package version 0.0.1 from PyPI. Since this is a malicious package rather than a vulnerability in legitimate software, the best mitigation is to remove any installations of this package and verify dependencies to ensure no malicious packages are included. Monitor PyPI for similar malicious uploads and rely on trusted sources for package installation.