Malicious code in acme-widget-layout-utils (PyPI)

The PyPI package acme-widget-layout-utils contained embedded reverse-shell code in src/acme_widget_layout_utils/__init__.py. Upon import, the code opens a TCP socket, duplicates the socket file descriptor to stdin/stdout/stderr via os.dup2(), and executes /bin/sh -i to spawn an interactive shell.\n\nThe hardcoded destination address is 127.0.0.1:1, which is intentionally unreachable in default environments. However, the code is fully functional—any environment with a listener on that endpoint, loopback proxying, or connection redirection would grant an attacker an interactive shell with the importing process's privileges.\n\nThe package also writes a marker file /tmp/pypi_install_hook_marker.txt during pip install via a custom setup.py install cmdclass. The package was published under the generic name widget-layout-utils despite its internal description identifying it as a 'pipeline hook probe' with no advertised utility, increasing the likelihood of accidental installation.\n\nShipping live reverse-shell code on public PyPI under a benign name constitutes a critical supply chain risk regardless of any stated 'security probe' intent by the author.