A pernicious potpourri of Python packages in PyPI

ESET Research identified a campaign that published 116 malicious Python packages across 53 PyPI projects (over 10,000 downloads) using techniques such as malicious test.py modules, PowerShell in setup.py, or purely malicious packages; these deliver a cross-platform backdoor (Python on Windows, Go on Linux), W4SP stealer variants, and clipboard-stealing malware, with persistence via scheduled tasks on Windows and XDG autostart entries on Linux; the report includes file hashes, a C2 domain, and MITRE ATT&CK mappings and notes that most packages were removed from PyPI.