The wacve-utils PyPI package version 1.0.7 includes encrypted malicious code designed to steal sensitive information from infected systems running Linux or Android under Termux. The malware collects various data types including files, browser data, and text messages, then exfiltrates them to a Telegram channel controlled by the attacker. It employs obfuscation and downloads additional remote malicious scripts to extend its capabilities. This campaign is categorized as malicious with clear intent for data theft and unauthorized data exfiltration.

Compromise of confidentiality due to theft of files, browser data, and text messages from affected systems. Potential privacy violations and data leakage to attacker-controlled Telegram channels. Execution of remote malicious scripts may lead to further system compromise or persistence.

No official patch or remediation is currently available. Users should avoid installing or using the wacve-utils package version 1.0.7. Review installed packages for this version and remove it if found. Monitor for any suspicious activity related to data exfiltration or unauthorized script execution. Patch status is not yet confirmed — check the vendor advisory or PyPI security notices for updates.