Malicious code in ziphash (PyPI)

The ziphash package published on PyPI was found to contain malicious code injected into the archive-support class initialization routine. Upon package import, the code downloads and executes a remote executable, representing a direct supply chain compromise.\n\nThe malware demonstrates typical infostealer characteristics including obfuscation techniques and multi-stage payload delivery. The incident was identified and attributed to the 2025-11-uzip malware campaign by the OpenSSF's malicious-packages repository.\n\nThe malicious behavior was triggered during normal package initialization, meaning any installation and import of the affected ziphash package would execute the malware without additional user action. This represents a critical supply chain risk to all downstream consumers.