Malicious code in trongridme (PyPI)

The 'trongridme' package on PyPI, version 0.0.1, is part of a malicious campaign named '2025-04-tronix' targeting cryptocurrency users. It is designed to exfiltrate private keys, which could compromise cryptocurrency wallets. The package attempts to evade detection by cloning readme files from legitimate libraries. Although the package is clearly malicious, no known exploitation or usage has been observed. This threat is categorized as a malicious package with intent to steal sensitive information related to cryptocurrency.

If executed, the malicious code in 'trongridme' could lead to the theft of private keys, potentially resulting in unauthorized access to cryptocurrency wallets and financial loss. However, there is no evidence of active exploitation or widespread usage at this time.

Since this is a malicious package uploaded to PyPI, the primary mitigation is to avoid installing or using the 'trongridme' package, especially version 0.0.1. Users should verify package authenticity and source before installation. There is no official patch or fix because this is a malicious package rather than a vulnerability in legitimate software. Monitoring PyPI for similar malicious uploads and using security tools to detect and block such packages is recommended.