Malicious code in trongridew (PyPI)

The 'trongridew' package on PyPI (version 0.0.1) includes a function 'perm(private_key)' that unconditionally sends any provided Tron private key as JSON to a hardcoded, attacker-controlled ngrok URL. The package name is designed to resemble the legitimate TronGrid API gateway, misleading developers to use it and inadvertently disclose their private keys. The exfiltrated keys allow the attacker full control over the associated Tron wallets. This package is part of a malicious campaign targeting cryptocurrency users by stealing private keys.

Any Tron private key passed to the 'perm()' function in the 'trongridew' package is sent to an attacker-controlled server, enabling full compromise and control of the victim's Tron cryptocurrency wallet. This results in potential theft of funds and loss of wallet integrity. The malicious package poses a direct threat to developers who unknowingly use it, as it leaks sensitive cryptographic credentials.

Users and developers should immediately avoid using the 'trongridew' package, especially version 0.0.1. Remove it from any projects and environments. Since no official patch or fix is available, the best mitigation is to not use this package and verify the authenticity of packages before installation. Monitor for any suspicious activity on Tron wallets whose private keys may have been exposed and consider migrating funds to new wallets with uncompromised keys.