Python Developers Warned of Trojanized PyPI Packages Mimicking Popular Libraries

Feb 23, 2023Ravie LakshmananSoftware Security / Supply Chain Attack

Cybersecurity researchers are warning of “imposter packages”
mimicking popular libraries available on the Python Package Index
(PyPI) repository.

The 41 malicious PyPI packages have been found to pose as
typosquatted variants of legitimate modules such as HTTP, AIOHTTP,
requests, urllib, and urllib3.

The names of the packages are as follows:

“The descriptions for these packages, for the most part, don’t
hint at their malicious intent,” ReversingLabs researcher Lucija
Valentić said^[1]
in a new writeup. “Some are disguised as real libraries and make
flattering comparisons between their capabilities and those of
known, legitimate HTTP libraries.”

But in reality, they either harbor downloaders that act as a
conduit to deliver second-stage malware to infected hosts or
information stealers that are designed to exfiltrate sensitive data
such as passwords and tokens.

Fortinet, which also disclosed^[2]
similar rogue HTTP packages on PyPI earlier this week, noted their
ability to launch a trojan downloader^[3]
that, in turn, contains a DLL file^[4]
(Rdudkye.dll) packing a variety of functions.

The development is just the latest attempt by malicious actors
to poison open source repositories like GitHub, npm, PyPI, and
RubyGems to propagate malware to developer systems and mount supply
chain attacks.

The findings come a day after Checkmarx detailed^[5]
a surge in spam packages in the open source npm registry that are
designed to redirect victims to phishing links.

“As with other supply chain attacks, malicious actors are
counting on typosquatting creating confusion and counting on
incautious developers to embrace malicious packages with
similar-sounding names by accident,” Valentić said.