Over two dozen Python packages in the PyPI registry were found to spread info-stealing malware, as researchers discovered.
Most of them contain obfuscated code that drops the “W4SP” info-stealer onto infected machines, while others use malware that is supposedly created only for “educational purposes”.
See also: Vodafone Italia reveals data breach – a reseller was hacked
31 typosquats drop ‘W4SP’ info-stealer
Researchers identified over two dozen Python packages in the PyPI registry that mimic popular libraries, but instead they drop info-stealers as they infect machines.
The packages are typosquats (see below) – that is, the threat actors who published them intentionally named them similar to well-known Python libraries, in the hope that developers trying to retrieve the real library will make a spelling mistake and accidentally retrieve one of the malicious libraries.
Yesterday, the company Phylum, which operates in the software supply chain security field, disclosed 29 packages in its report.
- algorithmic
- colorsama
- colorwin
- curlapi
- cypress
- duonet
- FAQ
- fatnoob
- felpesviadinho
- iao
- incrivelsim
- installpy
- oiu
- pydprotect
- pyhints
- pyptext
- pyslyte
- pystyle
- pystyte
- pyurllib
- requests-httpx
- shaasigma
- strinfer
- stringe
- sutiltype
- twyne
- type-color
- typestring
- typesutil
The research showed that the “typesutil” threat injects malicious code into code bases that come from legitimate libraries. This particular issue of importing via the “__import__” statement is something we have seen many times.
In the report, the researchers explain in great detail the challenges they faced while analyzing the obfuscated code that spans over 71,000 characters, which was «quite a bit of mud» they had to get through.
See also: Emotet returns after a five-month hiatus
Ultimately, researchers discovered that the malware in these packages was W4SP Stealer. This exfiltrates Discord tokens, cookies , and saved passwords from your device.
According to the statistics from Pepy.tech, Phylum researchers report that all packages combined have been downloaded more than 5,700 times.
Additionally, software developer and researcher Hauke Lübbers discovered the PyPI packages “pystile” and “threadings” that contain malware masquerading as the “GyruzPIP”.
The researcher noted that this malicious software is based on an open-source project called evil-pip. They warn, however, that this project was published for “educational purposes only”.
The code inside these two typosquats was very simple to parse: with each function name stating its purpose, e.g. stealing Chrome, browser cookies, Discord tokens, and uploading this data to a Discord.
Lübbers, who has reported these packages to PyPI maintainers, told BleepingComputer that for these projects to exhibit malicious behavior, they would likely need to be included as dependencies in a program.
See also: Hackers managed to introduce SocGholish malware into hundreds of news sites
The incident of this week is just one of the many recent typosquatting attacks that target developers who use open-source software distribution platforms such as PyPI and npm.
PyPI (Python Package Index) is a software repository for the Python programming language. It is similar to CPAN, the repository for Perl. PyPI helps you find and install software that has been developed and shared by the Python community. Currently there are more than 350,000 Python packages available on PyPI.
Information source: bleepingcomputer.com
