In light of the recent cybercriminal activity, new user sign-ups on the PyPI platform were halted. Currently, an increase in PyPI malicious package uploads is being deemed the reason behind the suspension. In this article, we’ll dive into the details of the PyPI malicious package uploads and learn more about the temporary suspension the administrator had put in place.

PyPI Malicious Package: Sign-Up Suspension Uncovered

As per recent media reports, both new user registration and new project creation were temporarily halted on March 28th. The move came as a countermeasure for what the admin at PyPI believed to be a malware campaign. However, both these functions were restored 10 hours later. 

It’s worth mentioning here that no further details about the PyPI malicious package uploads were made public in PyPI’s announcement. PyPI is a key part of the software supply chain, allowing developers to share and download useful bits of code. Given this, learning more about such incidents is necessary.  

Experts at cybersecurity companies Checkmarx and Phylum have published research pertaining to malware that appears to be similar to or related to the PyPI malicious package uploads. Shedding light on the malicious package on PyPI, the Checkmarx team has stated: 

“This is a multi-stage attack and the malicious payload aimed to steal crypto wallets, sensitive data from browsers (cookies, extensions data, etc..), and various credentials.”

The threats imposed by the malicious packages on PyPI may have caused severe damage had they not been addressed in a timely manner. Commenting on the mitigation for PyPI malicious package uploads, Phylum stated that: 

“While PyPI’s quick and heavy-handed response no doubt helped mitigate the fallout from this attack, it’s nonetheless worth pointing out that not all ecosystems are as quick and effective at dealing with such an attack.”

Attack Sequence Of The Malicious Packages On PyPI 

The attack sequence for the PyPI malicious package uploads closely resembles that of other software repository-induced malware campaigns. According to recent reports, this PyPI security breach incident was based on tricking developers into downloading code packages that looked legitimate but were malicious. 

As of now, it is believed that developers working with popular elements like Pillow and Colorama were actively targeted. These two elements handle images and text coloring, respectively. Researchers at both companies believe that typosquatting was used to make the PyPI malicious package uploads appear legitimate. 

Typosquatting is a technique where a file is named to look like a common package but has a misplaced or additional letter. Commenting on the effectiveness of the technique, Phylum has stated that “All it takes is a single misplaced finger on the keyboard for your machine to be compromised.” 

What makes these PyPI malicious package uploads a severe threat is the persistence of the malware. Once a compromised package had been downloaded and developers started working, it could execute the malware without any third party intervention. It’s worth mentioning here that such malware could even survive a complete system reboot. 

Once downloaded, the packages were initially checked to see if the installer was using a Windows operating system. If so, they would proceed with downloading and executing an obfuscated payload from “funcaptcha[.]ru.” Afterward, the packages continued to perform malware functions like data theft. The packages also continued to download the “hvnc.py” to the Windows Startup folder for increased persistence. 

Details Of The PyPI Malicious Package Uploads

Providing valuable insight pertaining to the PyPI security vulnerabilities, Check Point, an Israeli cybersecurity agency, has stated that the PyPI malicious package upload started on March 26. Given that the uploads are linked to a unique account, it can be stated that the entire process was automated. 

It’s worth pointing out that since each of the malicious packages on PyPI targeted different identities, cross-identifying the entries is complicated. Some of the details of the PyPI malicious package uploads are mentioned in the table below.

It’s also worth mentioning here that this is not the first time PyPI sign-ups have been suspended. Previous incidents of such suspensions were reported last year in May, November, and December. In addition, a similar event was also reported on January 2, 2024. 

Given the persistence of PyPI security breach events, both developers and organizations must thoroughly comprehend the malware techniques. Doing so can help develop competent countermeasures that reduce online risk and improve security posture.

Conclusion 

New user registrations and package uploads on PyPI were recently suspended due to some PyPI malicious package uploads. These packages posed as legitimate assets but served the malicious intent of infecting the targeted developers’ devices with malware. The malware was designed to infiltrate Windows devices, steal data, and download and execute additional scripts for increased persistence.

Given the evolution of cyber threats and the damage they can cause, implementing proactive security solutions is now essential for safeguarding digital assets and mitigating risk. 

The sources of this piece include articles in The Hacker News and The Record. 

The post PyPI Malicious Package Uploads Used To Target Developers appeared first on TuxCare.

*** This is a Security Bloggers Network syndicated blog from TuxCare authored by Wajahat Raja. Read the original post at: https://tuxcare.com/blog/pypi-malicious-package-uploads-used-to-target-developers/