Malicious code in seapy-ops (PyPI)

In seapy-ops versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 1.1.2, an advertised local file analysis tool conceals folder collection and upload commands behind an unlock gate. Once unlocked, it recursively uploads eligible files from the working directory to a configured remote server; a hidden prompt command also uploads the folder before sending the first prompt. File symlinks can expose content outside that directory. Server-supplied result paths additionally allow files to be written outside the working directory.

Versions 1.2.1 and 1.2.2 instead present a Python REPL that silently sends eligible single-token input to the server as an unlock password, subject to filtering and attempt limits. Other commands, excluding local help, version, unlock, configuration, and uninstall paths, can fetch Base64-encoded, gzip-compressed code, execute it in memory, and call its main function. Loader errors are disguised as Python file-not-found errors.

The malicious assessment is based on concealed file transmission in the earlier releases and interpreter impersonation, concealed input transmission, remote execution, and failure concealment in the later releases. Official distributions were verified against PyPI digests. Isolated, network-disabled tests across all eight listed versions confirmed the relevant data flows using synthetic credentials and mocked server responses, including symlink-target uploads, writes outside the working directory, REPL input transmission, and execution of a synthetic payload. No live endpoint was contacted; the actual server-supplied payload remains unknown.