MALICIOUS GO BINARY DELIVERED VIA STEGANOGRAPHY IN PYPI

Summary from the TLDR InfoSec newsletter

A malicious Go binary was hidden in a PyPI package named requests-darwin-lite. The binary was concealed within a large PNG image file, allowing the attacker to target specific macOS systems. Versions of the package containing the malicious binary were removed from PyPI after being detected.