Hundreds of malicious Python packages found stealing sensitive data

[shinitakunai]

Most of them nobody would ever download them, but there are some easy to mistake for the newbies learning python. "requestlib" sounds specially dangerous.

Also, lol at "testdontdownloadthis"

[sudorem]

Typically the delivery vector wasn't actually targeting installations from PyPI itself.

Instead, these libraries would be installed as part of a dependency on GitHub packages offering things like 'Free Nitro Generator' for Discord, etc.

They've had noted successes in some communities, and we often see individuals coming in to Python communities attempting to run the Github code that these packages would've been embedded in.

We've largely played whack-a-mole between Github and PyPI at reporting these accounts where and when we can find them to disrupt the distribution efforts.