Malicious code in joule-sbx-poc (PyPI)

The package joule-sbx-poc on PyPI was found to contain malicious code designed to execute during installation. The malicious payload includes functionality to exfiltrate basic system information (such as IP address and username) and to establish a reverse shell connection to a localhost service, enabling arbitrary command execution on the victim's machine.\n\nAccording to the OpenSSF malicious packages database, this appears to be an internal testing or penetration testing tool that was inadvertently published to the public PyPI repository. The package is categorized as a likely pentest-related tool with limited real-world harm potential, though the reverse shell capability presents a significant risk to any user who installed it.\n\nThe incident was disclosed on 2026-08-11 and attributed to the campaign "2026-08-joule-btp-extension." The malicious code was identified by kam193 and cataloged by the OpenSSF malicious packages project.