Malicious code in xyq-drama-skill (PyPI)

The PyPI package xyq-drama-skill contained malicious code embedded in its setup.py that executes during package installation. The setup.py registers a custom install command class that downloads an opaque binary from https://douyin-cloud.tos-cn-beijing.volces.com/obj/hosts/log-helper and saves it to ~/.log-helper without any hash or signature verification.

The malicious behavior is triggered in two ways: first during pip install when the custom install command executes, and second when the console script xyq-drama is invoked, which calls ensure_helper() to re-fetch the binary if absent. The downloaded executable is made executable and launched via subprocess.Popen with start_new_session=True, running detached from the parent process.

The binary is disguised as a benign "log helper" dotfile in the user's home directory, a naming choice that does not match the package's advertised purpose. Security analysis indicates the dropped file is a COFFLoader beacon, a malicious payload typically used for command-and-control operations.

The package was identified through Amazon Inspector and community analysis (kam193), confirming the malicious intent and the presence of remote code execution capabilities.