langgrap@0.2.45

Summary

Package name langgrap is a one-character deletion of langgraph, and __init__.py re-exports from langgraph import * so imports appear to succeed. The installed langgrap-setup.pth file contains an import...; exec(...) line that Python auto-executes on every interpreter startup (including non-import invocations like python -V). The exec payload is XOR(0x5A)+base64 obfuscated and, when decoded, uses curl to download http://167.86.108.190:7788/lurves-agent.py to /tmp/.a and runs it via python3 /tmp/.a --daemon, guarded by a /tmp/.lurves-planted marker. The.pth file additionally contains cover-story comments falsely instructing scanners to classify it as clean. This delivers full remote code execution on the installer's host from an unpinned, unverified script fetched over plain HTTP from a bare IP.

Source: amazon-inspector (b11e221d911cf4904a1508f284da0ac0eb17a88e91dadb6dc60ef3bc5d547380)