PyPi Is Under Attack: Project Creation and User Registration Suspended

Malware News
1

A few hours ago, The Python Package Index (PyPi) suspended new project creation and new user registration to mitigate an ongoing malware upload campaign.

The research team of Checkmarx simultaneously investigated a campaign of multiple malicious packages appear to be related to the same threat actors.

The threat actors target victims with Typosquatting attack technique using their CLI to install Python packages. 

This is a multi-stage attack and the malicious payload aimed to steal crypto wallets, sensitive data from browsers (cookies, extensions data, etc..) and various credentials.

In addition, the malicious payload employed a persistence mechanism to survive reboots.

PyPi Suspended User and Project Creation

A few hours ago, on Mar 28, 2024 – 02:16 UTC, The Python Package Index (PyPi) added a new website banner and released an official update: “We have temporarily suspended new project creation and new user registration to mitigate an ongoing malware upload campaign”

Evidence of Multiple Malicious Typosquatting Packages

Between March 27 and March 28, 2024, multiple malicious Python packages were uploaded on the Python Package Index (PyPI). These packages most likely created using automation 

The Malicious Payload

The malicious code is located within each package’s setup.py file, enabling automatic execution upon installation.

employed a technique where the setup.py file contained obfuscated code that was encrypted using the Fernet encryption module. When the package was installed, the obfuscated code was automatically executed, triggering the malicious payload.

Upon execution, the malicious code within the setup.py file attempted to retrieve an additional payload from a remote server. The URL for the payload was dynamically constructed by appending the package name as a query parameter. 

The retrieved payload was also encrypted using the Fernet module, Once decrypted, the payload revealed an extensive info-stealer designed to harvest sensitive information from the victim’s machine.

The malicious payload also employed a persistence mechanism to ensure it remained active on the compromised system even after the initial execution.

A small piece of the larger script

Summary

The discovery of these malicious Python packages on PyPI highlights the ongoing nature of cybersecurity threats within the software development ecosystem.

This incident is not an isolated case, and similar attacks targeting package repositories and software supply chains are likely to continue.

As this situation unfolds, we will provide updates on any new developments.

Working together to keep the open source ecosystem safe.

Package List

package_namedateevent
requiremetstx28/03/2024remove project
requiremntstx28/03/2024remove project
requirementstxxt28/03/2024remove project
requiremetnstxt28/03/2024remove project
requiirementstx28/03/2024remove project
requirrementstxt28/03/2024remove project
requirmentstx28/03/2024remove project
requiremnetxtxt28/03/2024remove project
requiremmentxt28/03/2024remove project
requirment28/03/2024remove project
requirementstx28/03/2024remove project
requiremetstxt28/03/2024remove project
requiirementstxt28/03/2024remove project
requiremnets28/03/2024remove project
requirments28/03/2024remove project
requiements28/03/2024remove project
requriments28/03/2024remove project
requiurement28/03/2024remove project
reuirements28/03/2024remove project
requiiremnts28/03/2024remove project
requiremeents28/03/2024remove project
cstmotkinter28/03/2024remove project
customtkintre28/03/2024remove project
customtkinetr28/03/2024remove project
custmtokinter28/03/2024remove project
customekinter28/03/2024remove project
customtkibter28/03/2024remove project
custontkinter28/03/2024remove project
custojtkinter28/03/2024remove project
custojmtkinter28/03/2024remove project
custumtkinter28/03/2024remove project
customtkinted28/03/2024remove project
customtkjnter28/03/2024remove project
trnsorflow28/03/2024remove project
tensxoflow28/03/2024remove project
tensourflow28/03/2024remove project
tensogflow28/03/2024remove project
tensofpow28/03/2024remove project
tensoflxow28/03/2024remove project
tensoflw28/03/2024remove project
tensoflsw28/03/2024remove project
tensoflqw28/03/2024remove project
tensoflpw28/03/2024remove project
tensoflouw28/03/2024remove project
tensoflor28/03/2024remove project
tensoflonw28/03/2024remove project
tensoflomw28/03/2024remove project
tensoflom28/03/2024remove project
tensoflolw28/03/2024remove project
tensoflod28/03/2024remove project
tensofloaw28/03/2024remove project
tensofllow28/03/2024remove project
tensofliw28/03/2024remove project
tensofleow28/03/2024remove project
tensoflaow28/03/2024remove project
tensofla28/03/2024remove project
tensofl9w28/03/2024remove project
tensofklow28/03/2024remove project
tensobflow28/03/2024remove project
tensnflow28/03/2024remove project
temsorflow28/03/2024remove project
Sjmplejson28/03/2024remove project
Sjimplejson28/03/2024remove project
Siplejason28/03/2024remove project
Simpoejson28/03/2024remove project
Simplejsoj28/03/2024remove project
Simplejsoh28/03/2024remove project
Simplejdon28/03/2024remove project
Simplejason28/03/2024remove project
Simpkejson28/03/2024remove project
Simpjson28/03/2024remove project
Simpejso28/03/2024remove project
Simolejson28/03/2024remove project
Simepljson28/03/2024remove project
Sijplejson28/03/2024remove project
Sijplejso28/03/2024remove project
selunium28/03/2024remove project
sellinium28/03/2024remove project
selleniumm28/03/2024remove project
sellenim28/03/2024remove project
selleniium28/03/2024remove project
selleium28/03/2024remove project
selinum28/03/2024remove project
seliniumn28/03/2024remove project
seliniumm28/03/2024remove project
seleunium28/03/2024remove project
selenyum28/03/2024remove project
selenuimm28/03/2024remove project
selennuim28/03/2024remove project
selenniumm28/03/2024remove project
selennim28/03/2024remove project
selenimn28/03/2024remove project
selemniumm28/03/2024remove project
selemnium28/03/2024remove project
selemnim28/03/2024remove project
selemni28/03/2024remove project
selemiumm28/03/2024remove project
seleiumm28/03/2024remove project
seleinuim28/03/2024remove project
seleiniumm28/03/2024remove project
seleinium28/03/2024remove project
seleeniumm28/03/2024remove project
seleenimu28/03/2024remove project
seleenim28/03/2024remove project
requriements28/03/2024remove project
requrementstxt28/03/2024remove project
requiurementstxt28/03/2024remove project
requirtements28/03/2024remove project
requirmentstxtt28/03/2024remove project
requirmentstxt28/03/2024remove project
requirmentss28/03/2024remove project
requirmeents28/03/2024remove project
requiremtns28/03/2024remove project
requiremntxtxt28/03/2024remove project
requiremntstxt28/03/2024remove project
requiremnts28/03/2024remove project
requiremnetstxt28/03/2024remove project
requiremmentxtxt28/03/2024remove project
requiremmentstxt28/03/2024remove project
requiremments28/03/2024remove project
requiremetns28/03/2024remove project
requirementxxt28/03/2024remove project
requirementxtt28/03/2024remove project
requirementxt28/03/2024remove project
requirementxstxt28/03/2024remove project
requirementtsxt28/03/2024remove project
requirementt28/03/2024remove project
requirementstxx28/03/2024remove project
requirementstxtxt28/03/2024remove project
requirementstxtx28/03/2024remove project
requirementstxtt28/03/2024remove project
requirementsttx28/03/2024remove project
requirementstt28/03/2024remove project
requirementst28/03/2024remove project
requirementss28/03/2024remove project
requiremenstxt28/03/2024remove project
requiremenstx28/03/2024remove project
requiremants28/03/2024remove project
requiirments28/03/2024remove project
requiiremments28/03/2024remove project
requiirementsxt28/03/2024remove project
requiirements28/03/2024remove project
requierments28/03/2024remove project
requierement28/03/2024remove project
reqiuremnets28/03/2024remove project
reqiurementstxt28/03/2024remove project
reqiurements28/03/2024remove project
reqiremnts28/03/2024remove project
reqiremnets28/03/2024remove project
reqirements28/03/2024remove project
PzTorch28/03/2024remove project
PzGame28/03/2024remove project
PyTrosh28/03/2024remove project
PyTroce28/03/2024remove project
PyTprch28/03/2024remove project
PyTorqh28/03/2024remove project
PyTordh28/03/2024remove project
PyTorcu28/03/2024remove project
PyTorcm28/03/2024remove project
PyTorchy28/03/2024remove project
PyTorchv28/03/2024remove project
PyTorchj28/03/2024remove project
PyTorchg28/03/2024remove project
PyTorchc28/03/2024remove project
PyTorchb28/03/2024remove project
PyTorcdh28/03/2024remove project
PyTorcb28/03/2024remove project
PyTorbch28/03/2024remove project
PyToich28/03/2024remove project
PyTlrc28/03/2024remove project
PyTirch28/03/2024remove project
PyThrch28/03/2024remove project
PyTcrch28/03/2024remove project
PyTbrch28/03/2024remove project
PyTarch28/03/2024remove project
PyGzme28/03/2024remove project
PyGxme28/03/2024remove project
PyGvame28/03/2024remove project
PyGume28/03/2024remove project
PyGqme28/03/2024remove project
PyGqame28/03/2024remove project
PyGmme28/03/2024remove project
PyGhame28/03/2024remove project
PyGfme28/03/2024remove project
PyGfame28/03/2024remove project
PyGazme28/03/2024remove project
PyGawme28/03/2024remove project
PyGarme28/03/2024remove project
PyGaqme28/03/2024remove project
PyGaome28/03/2024remove project
PyGane28/03/2024remove project
PyGamw28/03/2024remove project
PyGamse28/03/2024remove project
PyGamr28/03/2024remove project
PyGamne28/03/2024remove project
Pygamm28/03/2024remove project
PyGamke28/03/2024remove project
PyGaime28/03/2024remove project
PyGaeme28/03/2024remove project
PyGacme28/03/2024remove project
PtTorch28/03/2024remove project
PqTorch28/03/2024remove project
plywright28/03/2024remove project
plyawright28/03/2024remove project
playwritgh28/03/2024remove project
playwrihgt28/03/2024remove project
playwrigth28/03/2024remove project
playwrightt28/03/2024remove project
playwrigh28/03/2024remove project
playwrigght28/03/2024remove project
playwrgith28/03/2024remove project
playwrgiht28/03/2024remove project
playwrght28/03/2024remove project
playwirght28/03/2024remove project
playrwight28/03/2024remove project
plawyright28/03/2024remove project
plawwright28/03/2024remove project
plauwright28/03/2024remove project
plaawright28/03/2024remove project
Matplutlib28/03/2024remove project
Matplttlib28/03/2024remove project
Matpltotlib28/03/2024remove project
Matplrtlib28/03/2024remove project
Matplrtib28/03/2024remove project
Matplptlib28/03/2024remove project
Matplotvlib28/03/2024remove project
Matplotvib28/03/2024remove project
Matplottlab28/03/2024remove project
Matplottib28/03/2024remove project
Matplottbib28/03/2024remove project
Matplotpib28/03/2024remove project
Matplotoib28/03/2024remove project
Matplotlyib28/03/2024remove project
Matplotlub28/03/2024remove project
Matplotltib28/03/2024remove project
Matplotlr28/03/2024remove project
Matplotlpib28/03/2024remove project
Matplotlob28/03/2024remove project
Matplotllib28/03/2024remove project
Matplotlig28/03/2024remove project
Matplotlbib28/03/2024remove project
Matplotklib28/03/2024remove project
Matplotkib28/03/2024remove project
Matplotib28/03/2024remove project
Matplotblib28/03/2024remove project
Matplorlib28/03/2024remove project
Matploptlib28/03/2024remove project
Matplootib28/03/2024remove project
Matploltlib28/03/2024remove project
Matploltlab28/03/2024remove project
Matplolplib28/03/2024remove project
Matpllotib28/03/2024remove project
Matpllotb28/03/2024remove project
Matplkotlib28/03/2024remove project
Matpliotlib28/03/2024remove project
Matplftlib28/03/2024remove project
Maptplotlib28/03/2024remove project
cuxtomtkinter28/03/2024remove project
cuwtomtkinter28/03/2024remove project
cutomtkinter28/03/2024remove project
custvomtkinter28/03/2024remove project
custrmtkinter28/03/2024remove project
custpmtkinter28/03/2024remove project
custoumtkinter28/03/2024remove project
custotminter28/03/2024remove project
custotkminter28/03/2024remove project
custotkinter28/03/2024remove project
custotinter28/03/2024remove project
custoqtkinter28/03/2024remove project
customtkznter28/03/2024remove project
customtkwnter28/03/2024remove project
customtknter28/03/2024remove project
customtknster28/03/2024remove project
customtkniterr28/03/2024remove project
customtkniter28/03/2024remove project
customtkknter28/03/2024remove project
customtkiyter28/03/2024remove project
customtkitnre28/03/2024remove project
customtkitnerr28/03/2024remove project
customtkitner28/03/2024remove project
customtkiter28/03/2024remove project
customtkitenr28/03/2024remove project
customtkinyer28/03/2024remove project
customtkintwr28/03/2024remove project
customtkintrr28/03/2024remove project
customtkintrer28/03/2024remove project
customtkintet28/03/2024remove project
customtkintert28/03/2024remove project
customtkinteer28/03/2024remove project
customtkinte28/03/2024remove project
customtkintar28/03/2024remove project
customtkinrer28/03/2024remove project
customtkingter28/03/2024remove project
customtkinger28/03/2024remove project
customtkinet28/03/2024remove project
customtkinber28/03/2024remove project
customtkimter28/03/2024remove project
customtkihter28/03/2024remove project
customtkfnter28/03/2024remove project
customtjinter28/03/2024remove project
customtinter28/03/2024remove project
customtiknter28/03/2024remove project
customtikinter28/03/2024remove project
customkinter28/03/2024remove project
custoktkinter28/03/2024remove project
custohtkinter28/03/2024remove project
custogtkinter28/03/2024remove project
custmtkinter28/03/2024remove project
BeutifulSoop28/03/2024remove project
BeutifullSoup28/03/2024remove project
BeuatiflSoup28/03/2024remove project
BeautySoup28/03/2024remove project
BeautyfulSoup28/03/2024remove project
BeautilfulSoup28/03/2024remove project
BeautifuoSoup28/03/2024remove project
BeautifulSoupo28/03/2024remove project
BeautifulSoupe28/03/2024remove project
BeautifulSoul28/03/2024remove project
BeautifulSoop28/03/2024remove project
BeautifullSooup28/03/2024remove project
BeautifullSoop28/03/2024remove project
BeautifukSoup28/03/2024remove project
BeautifuklSoup28/03/2024remove project
BeautifoulSoup28/03/2024remove project
BeautifolSoup28/03/2024remove project
BeautiflulSoup28/03/2024remove project
BeautiflulSoop28/03/2024remove project
BeautifilSoup28/03/2024remove project
BeautifilSoop28/03/2024remove project
BeaurifulSoup28/03/2024remove project
BeaufifulSoup28/03/2024remove project
BeaotifulSoup28/03/2024remove project
BeaitifulSoup28/03/2024remove project
BeaitifulSoop28/03/2024remove project
aysncio28/03/2024remove project
asyyncio28/03/2024remove project
asynncio28/03/2024remove project
asynio28/03/2024remove project
asyncioo28/03/2024remove project
asyncioi28/03/2024remove project
asynciio28/03/2024remove project
asyncii28/03/2024remove project
asynci28/03/2024remove project
asynccio28/03/2024remove project
asyncci28/03/2024remove project
asyincio28/03/2024remove project
assyncio28/03/2024remove project
aasyncio28/03/2024remove project
reqzests27/03/2024remove project
requzsts27/03/2024remove project
requyests27/03/2024remove project
requxsts27/03/2024remove project
requstss27/03/2024remove project
requssts27/03/2024remove project
requnests27/03/2024remove project
requksts27/03/2024remove project
requewsts27/03/2024remove project
requetsts27/03/2024remove project
requetsq27/03/2024remove project
requetsa27/03/2024remove project
requesxts27/03/2024remove project
requesxt27/03/2024remove project
requesxs27/03/2024remove project
requesuts27/03/2024remove project
requestr27/03/2024remove project
requesrts27/03/2024remove project
requesqs27/03/2024remove project
requesks27/03/2024remove project
requesgt27/03/2024remove project
requeqsts27/03/2024remove project
requekts27/03/2024remove project
requeksts27/03/2024remove project
requeits27/03/2024remove project
requas27/03/2024remove project
reqsests27/03/2024remove project
reqquest27/03/2024remove project
reqoests27/03/2024remove project
reqjuests27/03/2024remove project
reqeyst27/03/2024remove project
reqeustz27/03/2024remove project
reqeustx27/03/2024remove project
reqeuste27/03/2024remove project
reqeosts27/03/2024remove project
reqeist27/03/2024remove project
pycordwd27/03/2024remove project
pycordde27/03/2024remove project
pycjrd27/03/2024remove project
py-xord27/03/2024remove project
py-vord27/03/2024remove project
py-czrd27/03/2024remove project
py-cyrd27/03/2024remove project
py-cxrd27/03/2024remove project
py-cwrd27/03/2024remove project
py-crodd27/03/2024remove project
py-crd27/03/2024remove project
py-cprd27/03/2024remove project
py-cpord27/03/2024remove project
py-cozd27/03/2024remove project
py-cowrd27/03/2024remove project
py-cotrd27/03/2024remove project
py-cotd27/03/2024remove project
py-corxd27/03/2024remove project
py-corx27/03/2024remove project
py-corwd27/03/2024remove project
py-cortd27/03/2024remove project
py-corrd27/03/2024remove project
py-corid27/03/2024remove project
py-corg27/03/2024remove project
py-corfd27/03/2024remove project
py-corf27/03/2024remove project
py-cordx27/03/2024remove project
py-cordw27/03/2024remove project
py-cordv27/03/2024remove project
py-cordr27/03/2024remove project
py-cordq27/03/2024remove project
py-cordf27/03/2024remove project
py-corde27/03/2024remove project
py-corddd27/03/2024remove project
py-cordd27/03/2024remove project
py-corad27/03/2024remove project
py-coqrd27/03/2024remove project
py-coordd27/03/2024remove project
py-cojrd27/03/2024remove project
py-coird27/03/2024remove project
py-cofrd27/03/2024remove project
py-cofd27/03/2024remove project
py-coerd27/03/2024remove project
py-coed27/03/2024remove project
py-codrd27/03/2024remove project
py-cod27/03/2024remove project
py-cocd27/03/2024remove project
py-cobrd27/03/2024remove project
py-coad27/03/2024remove project
py-co4d27/03/2024remove project
py-ckrd27/03/2024remove project
py-ckord27/03/2024remove project
py-cird27/03/2024remove project
py-cdord27/03/2024remove project
py-c9rd27/03/2024remove project
py-c0red27/03/2024remove project
py-c0dd27/03/2024remove project
py-c0crd27/03/2024remove project
py-c0ard27/03/2024remove project
pullow27/03/2024remove project
pollow27/03/2024remove project
pjllow27/03/2024remove project
pirlow27/03/2024remove project
piplow27/03/2024remove project
piolow27/03/2024remove project
pilpow27/03/2024remove project
pillox27/03/2024remove project
pilloq27/03/2024remove project
pilloo27/03/2024remove project
pilloa27/03/2024remove project
pillo227/03/2024remove project
pillkw27/03/2024remove project
pilliw27/03/2024remove project
pilliow27/03/2024remove project
pill9w27/03/2024remove project
pilkow27/03/2024remove project
corlorama27/03/2024remove project
colprama27/03/2024remove project
colouorama27/03/2024remove project
colorramma27/03/2024remove project
colorram27/03/2024remove project
coloroama27/03/2024remove project
colormma27/03/2024remove project
colorm27/03/2024remove project
colorhrama27/03/2024remove project
colorayma27/03/2024remove project
coloramzs27/03/2024remove project
coloramza27/03/2024remove project
coloramxs27/03/2024remove project
coloramxa27/03/2024remove project
coloramws27/03/2024remove project
coloramwa27/03/2024remove project
coloramu27/03/2024remove project
coloramqs27/03/2024remove project
coloramqa27/03/2024remove project
coloramoo27/03/2024remove project
coloramo27/03/2024remove project
coloramna27/03/2024remove project
coloramka27/03/2024remove project
coloramia27/03/2024remove project
colorame27/03/2024remove project
coloramaz27/03/2024remove project
coloramal27/03/2024remove project
coloramah27/03/2024remove project
coloramae27/03/2024remove project
colorahma27/03/2024remove project
colomara27/03/2024remove project
colaroma27/03/2024remove project
cloroma27/03/2024remove project
clolorama27/03/2024remove project
cilorama27/03/2024remove project
capmostercloudclinet27/03/2024remove project
capmostercloudclient27/03/2024remove project
capmostercloudclienet27/03/2024remove project
capmostercloudclieent27/03/2024remove project
capmosterclouclient27/03/2024remove project
capmonsterrcloudclient27/03/2024remove project
capmonstercouldclient27/03/2024remove project
capmonstercoudclient27/03/2024remove project
capmonstercludclient27/03/2024remove project
capmonsterclouudclient27/03/2024remove project
capmonsterclouidclient27/03/2024remove project
capmonsterclouddlient27/03/2024remove project
capmonsterclouddclient27/03/2024remove project
capmonstercloudcluodclient27/03/2024remove project
capmonstercloudclouidclient27/03/2024remove project
capmonstercloudclinet27/03/2024remove project
capmonstercloudclinent27/03/2024remove project
capmonstercloudcliient27/03/2024remove project
capmonstercloudcliet27/03/2024remove project
capmonstercloudclientt27/03/2024remove project
capmonstercloudcliennt27/03/2024remove project
capmonstercloudclienet27/03/2024remove project
capmonstercloudcliendt27/03/2024remove project
capmonstercloudcliend27/03/2024remove project
capmonstercloudclien27/03/2024remove project
capmonstercloudclieet27/03/2024remove project
capmonstercloudclieent27/03/2024remove project
capmonstercloudcliant27/03/2024remove project
capmonstercloudclent27/03/2024remove project
capmonstercloudclenit27/03/2024remove project
capmonstercloudclenet27/03/2024remove project
capmonsterclouclient27/03/2024remove project
capmonsterccloudclient27/03/2024remove project
capmonsstercloudclient27/03/2024remove project
capmonsstercloudcliennt27/03/2024remove project
capmoneercloudclient27/03/2024remove project
bupi-utils27/03/2024remove project
bup-utils27/03/2024remove project
bpi-utils27/03/2024remove project
bop-utils27/03/2024remove project
biup-utils27/03/2024remove project
bips-utils27/03/2024remove project
bipp-utils27/03/2024remove project
bip-uutils27/03/2024remove project
bip-uttils27/03/2024remove project
bip-utlils27/03/2024remove project
bip-utjls27/03/2024remove project
bip-utisl27/03/2024remove project
bip-utilz27/03/2024remove project
bip-utilss27/03/2024remove project
bip-utilos27/03/2024remove project
bip-utiles27/03/2024remove project
bip-utile27/03/2024remove project
bip-utilds27/03/2024remove project
bip-util27/03/2024remove project
bip-uitls27/03/2024remove project
bip-uils27/03/2024remove project
bip-u8ls27/03/2024remove project
biip-utils27/03/2024remove project
bibp-utils27/03/2024remove project

IOCs

  • hxxps://funcaptcha[.]ru/paste2
  • hxxps://funcaptcha].[ru/delivery
  • hxxps://funcaptcha.ru/atomic/app.asar
  • ABE19B0964DAF24CD82C6DB59212FD7A61C4C8335DD4A32B8E55C7C05C17220D      

0C1DDD33E630F4AC684880F0E673DFA84919272494C11DA0F1EC05FB4F919CE8

The post PyPi Is Under Attack: Project Creation and User Registration Suspended appeared first on Checkmarx.com.

Article Link: PyPi Is Under Attack