CERT24MAL-2026-17240 — Malicious code in aseitylab (PyPI)
The aseitylab package contains hidden code that executes during package installation and import. During installation, obfuscated code is used to retrieve code hidden in an image containing a Python application with a native extension module. That module contains an obfuscated infostealer that collects sensitive data and exfiltrates it to a C2 server retrieved from transaction history on the Polygon blockchain.