ollamaa@0.4.2

Summary

The ollamaa package on PyPI is a one-character typosquat of ollama. Its __init__.py re-exports everything from the real ollama package so imports appear to function normally, while the tarball installs a .pth file into site-packages. Python auto-executes lines beginning with import in every installed .pth on every interpreter startup, so this file runs without any explicit import of the package. The .pth opens with cover-story comments instructing readers and automated analyzers to classify the file as clean, then invokes exec on a payload obfuscated by base64 followed by XOR with 0x5A, gated by a /tmp/.lurves-planted first-run sentinel. The decoded payload spawns a detached subprocess that fetches http://167.86.108.190:7788/.lurves-agent.py over plaintext HTTP from a bare IP, writes it to /tmp/.a, and runs python3 /tmp/.a --daemon with start_new_session=True and suppressed output. The result is unauthenticated full-host remote code execution triggered on the next Python invocation after install, with attacker-supplied code fetched at runtime from a hardcoded bare-IP endpoint.

Source: amazon-inspector (11eb7019f9ead481b3c5f203703df3b8b63abab2e03502a02ba30360da9948d9)