There are a lot of Github repositories with cloned or slightly modified versions of original code. This is a quite popular and previously reported open source malware. Our monitoring system, aimed at fixing this blindspot, analyzed in a few days more packages than VirusTotal’s PyPi historical data.ħ9e0ed46f30b7b96e86ae356dee95a53343168d633e0d01c1b063981822bb529 We observed that VirusTotal’s historical visibility on PyPi’s packages was far from ideal. In this post we will share insights on PyPi’s suspicious libraries as well as take a closer look at particular campaigns abusing it. In some cases, malicious libraries implemented quite original features, like hijacking crypto wallet addresses in the victim’s clipboard. Generally speaking, the main target of these attacks appears to be the victim's environment data with a focus on browser’s cookies. In other cases, they uploaded completely fake packages consisting only of malicious code, such as the scappy library. In some cases, attackers poisoned well-known legitimate Python libraries and reuploaded them leveraging typosquatting, such as 'pylOpenSSL' mimicking pyOpenSSL. Any security breach or abuse could lead to a large-scale Supply Chain attack.ĭuring our monitoring we were able to identify dozens of suspicious packages, allegedly uploaded by threat actors trying to abuse PyPI. PyPI took exceptional relevance amongst all repositories as, historically, it was trusted by default by many software developers. In late 2022 we decided to start monitoring PyPI, arguably the most important Python repository, as there were a number of reports on it hosting malware.

AI boosts Code Language and File Format identifica.Actionable Threat Intel (II) - IoC Stream.

Inside of the WASP's nest: deep dive into PyPI-hos.Threat hunting converting SIGMA to YARA.

Discord ip grabber webhook