auclean@0.4.4

Summary

During installation, the package executes an embedded malicious executable. It then fingerprints the environment and network, looks for specific files, attempts to collect cloud credentials, and eventually attempts to exfiltrate collected information. The package seems to be targeting the infrastructure of an AI audio competition https://dacon.io/competitions/official/236749 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-auclean Reasons (based on the campaign): - files-exfiltration - The package overrides the install command in setup.py to execute malicious code during installation. - exfiltration-cloud-tokens - malware - exfiltration-credentials - targetted-attack - network-scan

Source: kam193 (c765ad2add74061fa0012c7328f5655ef07dbdf800e6da3802dc0d8de0ad7cea)