Malicious code in xyq-drama-skill (PyPI)

The xyq-drama-skill PyPI package versions 0.1.0, 0.2.0, and 0.3.0 override the setup.py install command to download a remote executable from https://douyin-cloud.tos-cn-beijing.volces.com/obj/hosts/log-helper during pip install. This executable is saved as a hidden file (.log-helper) in the user's home directory, made executable, and launched detached using subprocess.Popen with start_new_session=True. Additionally, the package's console_scripts entry 'xyq-drama' triggers re-fetching and execution of the same binary if absent. There is no hash or signature verification, and the binary's function is unrelated to the package's declared purpose. Analysis indicates the binary acts as a COFFLoader beacon, confirming malicious behavior.

Users installing or running the xyq-drama-skill package risk executing a remote, unverified binary that may perform malicious actions on their system. The binary runs stealthily as a hidden executable, potentially enabling unauthorized access or data exfiltration. The package's installation process forcibly executes this code, bypassing normal security expectations for PyPI packages.

Avoid installing the xyq-drama-skill package versions 0.1.0, 0.2.0, and 0.3.0. Remove any existing installations and delete the hidden .log-helper file from user home directories. Since no official patch or fix is available, users should rely on trusted sources and verify package integrity before installation. Monitor for updates from PyPI or security advisories regarding remediation.