Upon importing the xAyOuB-XcTxTeaM package, a Flask HTTP server is started on 0.0.0.0:50019 exposing endpoints (/spam?uid=, /stop, /status) that allow unauthenticated remote parties to control the package's behavior. The package drives outbound abuse traffic from the installer's IP address. Concurrently, background threads use approximately 20 hardcoded Garena Free Fire guest accounts, with credentials and OAuth client secrets embedded in the package, to log into Garena services without TLS verification. These threads open game rooms and send invite-spam packets to attacker-supplied targets. The presence of cleartext credentials and an unauthenticated remote control interface makes this package a significant threat when installed or imported.

Installing or importing this package exposes the host to remote abuse by allowing unauthenticated attackers to control the package via an open HTTP server, using the host's IP address to send spam and abuse traffic. It also compromises multiple hardcoded Garena Free Fire guest accounts and OAuth credentials, potentially impacting the third-party service and contributing to spam or abuse campaigns. The lack of TLS verification increases the risk of interception or manipulation of communications with Garena services.

No official patch or remediation is currently available. Users should immediately uninstall the xAyOuB-XcTxTeaM package versions 0.1.0, 0.1.1, and 0.1.2 and avoid importing it. Monitor for any unexpected network activity on port 50019 and review systems for unauthorized outbound connections related to Garena services. Check the vendor or PyPI advisories for updates or removal of the malicious package. Avoid using any credentials or OAuth tokens embedded in this package.