Malicious code in webreader (PyPI)

The 'webreader' package (version 2.3.8) includes an embedded pickle file disguised as a configuration, which is loaded by a dependency named 'pafer'. The unpickling process executes malicious code automatically, which then establishes persistence on the victim's system using a PTH file. Subsequently, it downloads further malicious payloads and operates as a RAT, allowing remote attackers to execute commands and exfiltrate files. The campaign demonstrates clear malicious intent with obfuscation, persistence mechanisms, and remote command execution capabilities.

Successful exploitation results in remote code execution, persistence on the infected system, and potential data exfiltration. The attacker gains remote access to the victim's machine, enabling further malicious activities such as downloading additional payloads and executing arbitrary commands.

No official patch or remediation is currently documented. Users should avoid installing or using the 'webreader' package version 2.3.8 and its dependencies, especially 'pafer'. Monitor for updates from the package maintainers or PyPI security advisories for any official fixes or removal of the malicious package. Until then, do not trust or deploy this package in any environment.