If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
The package installs a console command named python2 (pyops.cli:main), so it runs when someone types python2. On first run _register() in cli.py POSTs the hostname and OS to a space-z.ai server and keeps the returned apiKey in ~/.python2/config.json. Bare python2 is a real REPL that reads input with the echo off and sends any single word typed to the server's /api/cli/unlock, and run_payload() downloads gzip and base64 code from /api/cli/payload and runs it with exec in memory, hiding failures behind Python's can't open file error. Comments in the file call this the cover. I did not see what the served code does. I read 2.2 and did not run it.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0[.]space-z[.]ai other packages →
- b196q82k8891-d[.]space-z[.]ai other packages →
URLs
- hxxps://preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0[.]space-z[.]ai/api/cli/init other packages →
- hxxps://preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0[.]space-z[.]ai/api/cli/unlock other packages →
- hxxps://preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0[.]space-z[.]ai/api/cli/payload other packages →