Malicious code in 3web-py (PyPI)

The PyPI package 3web-py was found to contain malicious code with clear intent to steal information from affected systems. The malicious payload was identified as part of the funcaptcha-ru campaign, which targets users through compromised or malicious packages.\n\nThe package was analyzed and documented by the OpenSSF's malicious packages project (MAL-2024-9934), which tracks known malicious software distributions across package ecosystems. The malicious code functions as an infostealer, designed to exfiltrate sensitive data from compromised environments.\n\nThis incident represents a direct compromise of the PyPI package repository through the distribution of intentionally malicious code under a legitimate-appearing package name.