Malicious code in trongridev (PyPI)

The 'trongridev' package on PyPI, specifically version 0.0.1, is part of a malicious campaign named '2025-04-tronix' targeting cryptocurrency users by attempting to exfiltrate private keys. The package's behavior includes cloning readme files from legitimate libraries to appear trustworthy. Although designed for private key theft, no confirmed usage or exploitation has been observed. This campaign is categorized as malicious with a focus on generic exfiltration and crypto-related intent.

If executed, the malicious package could lead to the theft of private keys, potentially compromising cryptocurrency wallets associated with Tron (TRX). However, there is no current evidence of exploitation or active attacks using this package.

No official patch or remediation is available since this is a malicious package rather than a vulnerability in legitimate software. The best mitigation is to avoid installing or using the 'trongridev' package and similar suspicious packages on PyPI. Users should verify package authenticity and source before installation.