The official Python Package Index (PyPI) repository got rid of 11 malicious packages that stole user data (including Discord tokens and passwords) and installed shells on victims’ systems (for remote access by attackers).
In total, the packages have been downloaded and installed over 30,000 times, according to DevOps JFrog, who discovered this set of malicious libraries.Almost all libraries were developed by different authors, as each of them demonstrated different malicious behaviour and extracted data from infected machines in its own way:
- Importantpackage (downloaded 6305 times) and important-package (downloaded 12,897 times): hidden connectback shell for psec.forward.io.global.prod.fastly.net using the trevorc2 client;
- pptest (downloaded 10,001 times): used DNS to send hostname + ‘|’ + os.getcwd () + ‘|’ + str (self.get_wan_ip ()) + ‘|’ + local_ip_str;
- ipboards (downloaded 946 times): dependency confusion, sent user data (username, hostname) via DNS tunneling to b0a0374cd1cb4305002e.d.requestbin.net;
- owlmoon (uploaded 3285 times): a Trojan stealing Discord tokens, tokens were sent to https://discord.com/api/webhooks/875931932360331294/wA0rLs3xX_2JgqlfqEfpYoL9zer_ Qs7hpsymbwaDlZ3
- DiscordSafety (uploaded 557 times): Trojan stealing Discord tokens, tokens were sent to https://tornadodomain.000webhostapp.com/stlr.php?token=;
- Trrfab (downloaded 287 times): dependency confusion, sent user data (id, hostname as well as / etc / passwd, / etc / hosts and / home) to yxznlysc47wvrb9r9z211e1jbah15q.burpcollaborator.net;
- 10Cent10 (downloaded 490 times) and 10Cent11 (downloaded 490 times): connectback shell with hard-coded address 104.248.19.57;
- yandex-yt (downloaded 4183 times): prints pwned messages and points to a possibly malicious domain at https://nda.ya.ru/t/iHLfdCYw3jCVQZ;
- yiffparty (uploaded 1859 times): a Trojan stealing Discord tokens, tokens were sent to https://discord.com/api/webhooks/875931932360331294/wA0rLs3xX_2JgqlfqEfpYoL9zer_ Qs7hpsymbwaDlZ6-RiBlUBlUBl_Qs7hpsyqwaDlZR3HiRiRu
Thus, 10 out of 11 packages were openly malicious, while the yandex-yt library could be some kind of test or a joke, although it could also turn into a malware delivery channel.
The researchers also emphasize that the two packages abused the relatively new dependency confusion technique. That is, attackers registered packages with names that could be used inside closed corporate networks, hoping that their package would be used after the corporate package was removed (if the dependency tree was not updated).
Let me also remind you that we talked about the Spammers attack PyPI and GitLab repositories.
