Citrine Sleet Poisons PyPI Packages With Mac & Linux Malware

Unit 42 attributes a supply-chain campaign to DPRK-linked APT Gleaming Pisces (Citrine Sleet), which uploaded malicious PyPI packages (e.g., `real-ids`, `minisound`, `coloredtxt`, `beautifultext`) that decode and execute payloads to retrieve the PondRAT remote-access Trojan for macOS and Linux; the packages were taken down but illustrate developer-targeted supply-chain and social-engineering tactics.