CERT24MAL-2026-17196 — Malicious code in donutpromotion (PyPI)
donutpromotion presents itself as a Minecraft SMP donation and rank-promotion helper, but the published 0.1.0 release executes an encrypted downloader before the package is processed. The installation process can download and execute remote code, and the source describes a second-stage infostealer.