Malicious code in speed-hashes (PyPI)

The speed-hashes package on PyPI was compromised with malicious code distributed under multiple source identifiers. The first variant (amazon-inspector) defines a custom NativeInstall command in setup.py that executes during pip install. It decodes a base64-encoded payload and executes it via exec(compile(...)), disguising the malicious code under names mimicking legitimate native-extension setup routines.

The decoded payload downloads an opaque binary from github.com/totti2188/8gp1Q7iZD3h4VW/releases/download/v1.3A/something to /tmp/something, makes it executable (chmod 0755), and spawns it as a detached process. The publisher metadata falsely references github.com/nickolasburr/fast-hashes, which does not match the actual download source, indicating account takeover or impersonation.

A second variant (kam193) similarly imitates the name of a popular library and uses obfuscated code to download and execute a malicious executable during installation. This variant exfiltrates cryptocurrency wallet data and likely other sensitive information from the infected system.

Both variants achieve remote code execution on the installer's host through the automatic execution of attacker-controlled code during the pip install lifecycle. The campaign is tracked as 2026-08-flasq and demonstrates clear malicious intent through data exfiltration and infostealer functionality.