A new malicious package, bundyfed, has been discovered on the PyPI package repository. The package installs a malicious executable that contains an infostealer, a type of malware that steals sensitive information. The malicious code is triggered during installation, overriding the install command in setup.py to execute the infostealer. This poses a significant risk to developers who use bundyfed, as it can compromise their systems and steal sensitive data.

A vulnerability in the parseyaml package on PyPI has been identified, allowing remote code execution through a malicious dependency posing as a YAML loader. The code embeds a stub that executes code from a provided file, indicating malicious intent similar to infostealers. This vulnerability matters to developers and operators as it enables remote code execution, potentially compromising systems and data.

A malicious code campaign has been identified in the extrahtml package on the PyPI repository. The malicious code, embedded in a YAML loader dependency, executes remote code by downloading and running a script from a provided file. This campaign has malicious intent, similar to infostealers, and is categorized as a clear threat. The malicious code is intentionally included in the package, and its purpose is to execute remote code, making it a serious security concern for developers and users of the extrahtml package.