GHSA-x6xg-3fj2-4pq3: 
Python vulnerability analysis and mitigation

The exotel project on PyPI was compromised through a user account phishing attack in August 2022. The attackers published a malicious version 0.1.6 of the package that contained harmful code designed to steal environment variables and execute malware during installation (GitHub Advisory, PyPA Advisory).

The compromised version 0.1.6 of the exotel package was designed to collect environment variables and download and execute malware during the package installation process. The vulnerability has been assigned a high severity rating (GitHub Advisory).

When installed, the malicious package version 0.1.6 could steal sensitive environment variables and execute malware on the target system, potentially leading to system compromise and data theft (GitHub Advisory).

Users should immediately remove version 0.1.6 of the exotel package if installed. No patched versions have been released, and users should exercise caution when installing any version of this package (GitHub Advisory).

PyPI officially acknowledged the security incident through their Twitter account, alerting users about the compromise (PyPI Tweet).