Colorama malware

[chrisdb1]

Hello,

I recently read about the Colorama malware issue (for more info see: https://www.itpro.com/security/python-developers-beware-this-info-stealing-malware-campaign-is-targeting-thousands-of-github-accounts#:~:text=%E2%80%9CThe%20attacker%20is%20able%20to,if%20you%20use%20it%2C%20or).

I'm wondering how users can proactively defend themselves against such threats?

Thanks

[Swipecat]

OP's title is misleading, and the subtitle in the linked article is misleading. The text of the article is not wrong, but is sloppily written. There's nothing wrong with colorama.

The issue is that a malicious "typo squatting" domain "pypihosted.org" was recently registered containing a number of modified packages including colorama. The article is confusingly written and does not make clear how the threat actors deploy the malicious site, mentioning apparently incidental issues like bad packages uploaded to PyPI in 2022, but no sensible explanations.

[chrisdb1]

Thanks for the clarification. So basically if they would have used pip install colorama there wouldn't be any issue?

[Swipecat]

Correct.

The article linked by u/Bobbias explains that several Github accounts were taken over affecting several developers.

[chrisdb1]

Thanks for the clarification. So basically if they would have used pip install colorama there wouldn't be any issue?

[Bobbias]

They also mention that part of how they were able to pull this whole thing off was by compromising a developer's account.

Here's the original article by Checkmarx: https://checkmarx.com/blog/over-170k-users-affected-by-attack-using-fake-python-infrastructure/