The turbocalcng Python package versions 0.1.0 and 0.2.0 include an obfuscated module that, during import, decodes and executes native shellcode in-memory. This is achieved by XOR-decoding strings to dynamically import modules such as base64, ctypes, mmap, and threading, then allocating a read-write-execute memory region where attacker-supplied code is written and executed via ctypes function pointer casting inside a daemon thread. Additionally, the package communicates with an external domain (dockfinancial[.]lu), though the exact nature of this communication is unknown. The obfuscation and execution pattern are characteristic of malicious code injection rather than legitimate functionality.

Importing the affected turbocalcng package versions results in execution of arbitrary native code within the Python process, potentially allowing attackers to execute any code with the privileges of the importing user. This can lead to system compromise, data theft, or further malicious activity. The external communication suggests possible data exfiltration or command and control interactions.

No official patch or remediation is currently available. Users should immediately remove and avoid installing turbocalcng versions 0.1.0 and 0.2.0 from PyPI. Monitor for any use of this package in your environment and consider blocking network communication to the domain dockfinancial.lu. Verify dependencies and supply chain integrity to prevent installation of malicious packages.