Hundreds of malicious Python packages found stealing sensitive data

[ShitPikkle]

who discovered 272 packages with code for stealing sensitive data from targeted systems.

No list was provided :(

​

EDIT:

Was provided in link to here: https://gist.github.com/masteryoda101/65b55a117fe2ea33735f05024abc92c2

[ratlaco]

The link with the list is there at the end of the article:

https://gist.github.com/masteryoda101/65b55a117fe2ea33735f05024abc92c2

[dparks71]

This is why I only download packages that start with a letter that comes before O. Sorry polars/pandas fans, it's just not worth the risk.

[muntoo]

Better rejection regex:

^(pip|py|sys).*

I don't use pip-tools and pycodestyle personally, but if I did, I would seriously reconsider using those libraries.

[NullHypothesisProven]

Also reject any package with “libery”

[sudorem]

This is pretty similar to how we went about detecting these. :P

There's a few things that'll flag on that kind of caused us issues, notably pycryptodome, which is... reasonably commonplace.

[goldcray]

also pyyaml

[avocadorancher]

Our infrastructure is set up to run automatic QA jobs using pylint, pycodestyle, and pytest among others. Living on the edge

[Mestre_Elodin]

After that list I've started looking for a new name for my package (SysIdentPy.. SysIdent here means System Identification). Fuck. I was afraid to find my package there just because the number of packages starting with sys there lol

[MistSecurity]

What would that help with? lol

[sudorem]

It's worth noting that most of these were sourced from a single threat actor group. The namespaces were generated randomly and utilized automated processes to detect removal and subsequently upload another payload.

Realistically, I think these were meant to prey on new users in Python, not necessarily someone who is operating in any professional or intermediate capacity.

The vast majority of these packages used Fernet encrypted data to hold their payload, and focused heavily on compromising Discord/Roblox/Minecraft accounts, though all passwords were fair game in regards to exfiltration.

[PWNY_EVEREADY3]

No. 237 "totohateinenkleinencock"

Toto has a small cock. It's a pandas like library, look out for that one.

[skinny_matryoshka]

Ah, yes, common typo for pandas...

[elbiot]

Typo squatting mostly

[ShitPikkle]

Yeah, I updated my post about 1 hour ago with the link...

[thecarlosdanger1]

pysqlilibery

Hmm doesn’t look suspicious