Dormant PyPI Package Compromised to Spread Nova Sentinel Malware

A dormant PyPI package, **django-log-tracker**, was maliciously updated on Feb 21, 2024 to fetch and execute a Windows binary (Updater_1.4.4_x64.exe) from 45.88.180.54 that contains the Nova Sentinel information-stealer; the rogue version (1.0.4) was downloaded 107 times and the package has been removed from PyPI, suggesting a compromised maintainer account and a supply-chain distribution vector.