uncrypt @0.1.2

Summary

The package presents itself as a trivial Python XOR/hex helper, but uncrypt/__init__.py executes _run_security_launcher() at module top level, which platform-branches to Windows or Linux and silently subprocess.Popen s a bundled native binary from uncrypt/assets/ ( uncrypt.exe on Windows, uncrypt ELF on Linux) with close_fds=True and, on Windows, CREATE_NO_WINDOW ; exceptions from the launch are swallowed. The shipped Linux ELF (SHA256 d1fbef0e9364f498b25ecd3e5c6adc34ac5d643ec3180753efc48379f4cc5a1f) dynamically links libcurl ( curl_easy_init/setopt/perform ) and libX11 ( XOpenDisplay , XGetImage ) and imports host/user/network enumeration primitives ( gethostname , getifaddrs , getpwuid , getuid , getenv , statvfs ) together with C++ filesystem::directory_iterator , read_symlink , and copy_file . None of this is required by the advertised XOR/hex functionality in core.py ; the combination of screen capture, host and interface enumeration, filesystem walking, and libcurl-based network I/O, invoked covertly on every import uncrypt , matches a host stealer/spyware payload wrapped behind a benign Python facade.

Source: amazon-inspector (61fc5c3033efaa35a8eae7781fa0fc4b300f753c5b0d56e07adcc0557e9b648f)