Malicious Python Package Hides Sliver C2 Framework in Fake Requests Library Logo

Researchers found a malicious PyPI package named requests-darwin-lite that masqueraded as a fork of the popular requests library and concealed a Golang-based Sliver C2 binary inside an oversized PNG logo; the package decodes and executes a Base64 command on macOS, checks the system UUID to target specific hosts, and was downloaded 417 times before takedown, highlighting a supply-chain malware vector using steganography and conditional execution.