10 malicious PyPI packages found stealing developer’s credentials

Threat analysts have discovered ten malicious Python packages on the PyPI repository, used to infect developer’s systems with password-stealing malware.

The fake packages used typosquatting to impersonate popular software projects and trick PyPI users into downloading them.

PyPI (Python Package Index) is a repository of over 350,000 open-source software packages that millions of registered users can easily incorporate into their Python projects and build complex products with minimal effort.

Malware operators take advantage of the platform’s open nature and frequently upload malicious or fake packages to compromise developers’ systems.

From there, the threat actors target the developers and their assets for supply-chain attacks, steal proprietary source code, or look for potential pivoting points in the software development environment.

Ten Pypi packages used to steal credentials

The malicious PyPi packages discovered by CheckPoint and outlined in a new report are:

• Ascii2text – Mimicking “art,” a popular ASCII Art Library for Python, Ascii2text uses the same description minus the release details. Its code fetches a malicious script that searches for local passwords and exfiltrates them via a Discord webhook.

• Pyg-utils, Pymocks, PyProto2 – All three packages target AWS credentials and appear very similar to another set of packages discovered by Sonatype in June. The first even connects to the same domain (“pygrata.com”), while the other two target “pymocks.com”.
• Test-async – Package with a vague description that fetches malicious code from a remote resource and notifies a Discord channel that a new infection has been established.
• Free-net-vpn and Free-net-vpn2 – User credential harvester published to a site mapped by a dynamic DNS mapping service.

• Zlibsrc – Mimicking the zlib project, this package contains a script that downloads and runs a malicious file from an external source.
• Browserdiv – Package targeting the credentials of web design programmers. Uses Discord webhooks for data exfiltration.

• WINRPCexploit – A credential-stealing package that promises to automate the exploitation of the Windows RPC vulnerability. However, when executed, the package will upload the server’s environment variables, which commonly contain credentials, to a remote site under the attacker’s control.

Although the discovered packages were reported by CheckPoint and removed from PyPI, software developers that downloaded them on their systems could still be at risk.

If you have downloaded and used any of the above packages, consider yourself compromised and take appropriate action.

In many cases, the malicious packages laid the ground for possible supply chain attacks, so the developer’s computer may just be the initial point of a widespread infection, and code should be audited for malicious code.

It is important to remember that no package in PyPI comes with security guarantees, and users are responsible for scrutinizing names, release histories, submission details, homepage links, and download numbers.

All these elements collectively can help determine if a Python package is trustworthy or potentially malicious.

Source: https://www.bleepingcomputer.com/news/security/10-malicious-pypi-packages-found-stealing-developers-credentials/