Malicious code in uvhttp-custom (PyPI)

The uvhttp-custom PyPI package contains an obfuscated payload in its setup.py that executes during installation. The payload decodes a base64 string to write a PowerShell script to disk, which then downloads an unsigned executable from a Discord CDN and runs it hidden from the user. No integrity checks are performed on the downloaded binary. This malicious behavior is triggered by simply running pip install on affected versions, leading to arbitrary code execution on Windows systems.

Installing affected versions of uvhttp-custom on Windows results in the silent download and execution of an unsigned executable from an external source. This can lead to arbitrary code execution on the victim's machine, potentially compromising system integrity and security. The lack of signature or hash verification increases the risk of executing malicious payloads without user awareness.

Users should avoid installing the uvhttp-custom package versions 1.7.9, 1.8.1, and 1.9.9. Since no official patch or remediation is indicated, the best mitigation is to remove these versions from use and rely on trusted package sources. Verify package integrity before installation and monitor for updates or advisories from PyPI or the package maintainer regarding this issue.