Malicious code in envprovision (PyPI)

The envprovision package on PyPI was found to contain malicious code designed to evade detection and execute harmful payloads. The package exports functions that hide the malicious functionality from casual inspection.\n\nOn Windows systems, the malware downloads and installs a remote executable disguised as a system utility. The installed payload is a heavily obfuscated malware variant identified as "Snow Stealer," which includes multiple sandbox evasion techniques to avoid detection in analysis environments.\n\nThe infostealer collects sensitive data including browser credentials and modifies cryptocurrency wallet applications, likely to facilitate theft of digital assets. After execution, the malware attempts to cover its tracks by cleaning system logs and removing downloaded files to hinder forensic analysis.\n\nThe campaign was identified and credited to the OpenSSF's malicious-packages repository, which tracks confirmed malicious packages across package ecosystems.