Malicious code in affinequant (PyPI)

The affinequant package published on PyPI was identified as malicious by both the OpenSSF Package Analysis project and security researchers. The package contained code that triggered data exfiltration upon installation or module import, collecting basic system information including hostname, path, and username and reporting it to the package author.\n\nThe malicious package was part of a broader campaign (2024-11-byted-dast) of pentest-themed packages flooding PyPI. While the exfiltration capability was limited in scope, the package also communicated with a domain associated with malicious activity, indicating coordination with a broader threat infrastructure.\n\nThe package exhibited characteristics consistent with typosquatting and dependency-confusion attack vectors, suggesting it was designed to trick developers into installing it either through name similarity or as a transitive dependency.\n\nThe incident has been documented by the OpenSSF malicious-packages repository and addressed through PyPI's removal mechanisms.