The 'uncrypt' Python package masquerades as a simple XOR/hex utility but executes a native binary on import that performs extensive system reconnaissance and data exfiltration. The Linux ELF binary dynamically links to libcurl and libX11, enabling network communication and screen capture, respectively. It collects hostnames, user info, network interfaces, and filesystem data, then communicates with an external domain to exfiltrate browser and system data. The package also includes sandbox detection mechanisms. This behavior is not related to the advertised functionality and indicates a host stealer/spyware payload.

Users who install or import the affected 'uncrypt' package versions risk silent execution of spyware that collects sensitive system and browser data and exfiltrates it to external servers. This compromises user privacy and system confidentiality. The malicious code runs covertly on import, increasing the risk of unnoticed data theft.

No official patch or remediation guidance is provided. Users should immediately uninstall affected versions (=0.1.0, =0.1.1, =0.1.2) of the 'uncrypt' package and avoid using it. Verify package integrity before installation and prefer trusted sources. Monitor for suspicious network activity related to this package. Patch status is not yet confirmed — check the vendor advisory or PyPI for updates.