Stealing SSH and GPG keys. According to Martini, the malicious code was present only in the jeIlyfish library. The python3-dateutil package didn't contain malicious code of its own, but it did ...

Data is transferred from the server in clear text, which allows man-in-the-middle (MiTM) attacks to take place -- and drops of additional PHP scripts which call up the ransomware to attack victim PCs.