Malicious code in zhopaorlaaato (PyPI)

The PyPI package zhopaorlaaato has been identified as containing malicious code with clear intent to steal credentials. The package runs an infostealer that specifically targets Telegram and Discord credentials, as well as browser data exfiltration.\n\nThe malware implementation varies by package version: some versions have the infostealer embedded directly within the package, while others download and execute a remote malicious script. This dual approach suggests active development and iteration of the attack.\n\nThe campaign has been tracked as 2025-08-dsidelib and was identified through analysis by the OpenSSF's malicious-packages project. The package should be considered actively malicious and poses a direct threat to any system that installs it.