pyyi@2.4.2

Summary

The package registers a console_scripts entry named python2 and presents a convincing fake 'Python <version> on <platform>' REPL banner so the shell is indistinguishable from the real CPython 2 interpreter. On first invocation it POSTs the machine hostname and OS/platform to a hardcoded server at https://preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai (and https://b196q82k8891-d.space-z.ai) under /api/cli/init to enroll the host and receive an apiKey stored in ~/.python2/state.json. The CLI then fetches a payload from /api/cli/payload on the same server, base64-decodes and gzip-decompresses the response, and runs it with exec(compile(src, '<adv>', 'exec'), g) followed by g['main'](argv) — arbitrary Python chosen by whoever controls the server runs on the installer's host, with no pinning, hash, or signature. The fake REPL puts the TTY in cbreak/no-echo mode via _quiet_read so typed characters are not displayed; any single-token line is forwarded to /api/cli/unlock as a password field alongside the apiKey, and is additionally persisted XOR-scrambled under ~/.python2/. In-source comments describe the Python interpreter facade as deliberate cover ('that is the whole cover', 'the boring cover for every failure'), and the README states the package 'intentionally contains no working commands' — all behavior is server-delivered. Attacker-controlled destinations: preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai, b196q82k8891-d.space-z.ai.

Source: amazon-inspector (7ac60870a568a1e1336d1d1696b9129a0f8bc13da7395fc24ed23ec4e8bf791e)