PyPI and npm packages have become a favorite among threat actors to abuse. In a new supply chain campaign, attackers were found typosquatting popular PyPI packages to propagate malware.
Diving into details
- One of the binaries is ransomware that will update the victim’s desktop background and encrypt some files, upon encryption.
- Soon, however, the threat actors started publishing multiple npm packages that behave similarly. They ask for $100 in BTC, XMR, ETH, or LTC for the decryption key.
- As of Friday, the list of PyPI packages include rdquests, reauests, reduests, reeuests, reqhests,dequests, fequests, gequests, reqkests, requesfs, requesta, requeste, requestw, requfsts, resuests, rewuests, rfquests, rrquests, rwquests, telnservrr, and tequests.
- The malicious npm packages include discordallintsbot, discordselfbot16, discord-all-intents-bot, discors.jd, and telnservrr.
Threats to PyPI and npm
In November, a threat actor was found releasing several malicious PyPI packages that are designed to steal credentials, personal information, and cryptocurrency from targeted machines. These malicious packages delivered the WASP infostealer.
- In the same month, researchers spotted 29 malicious packages, operating online as typosquatted names of genuine packages, and were downloaded over 5,700 times. Among these 29 packages, 27 dropped the W4SP infostealer.
- In October, LofyGang was spotted delivering 200 malicious packages and fraudulent hacking tools on npm and GitHub. It aimed to steal credit card details and user accounts from Discord Nitro, gaming, and streaming services.
The bottom line
Cybersecurity experts warn that the number of malicious PyPI and npm packages will increase in the future. The attacker is still active and has been publishing more malware packages to PyPI. Python and JavaScript developers are recommended to follow the required cybersecurity hygiene and stay safe.
Publisher
/https://cyware-ent.s3.amazonaws.com/image_bank/6f4a_shutterstock_1567182328.jpg)
/https://cyware-ent.s3.amazonaws.com/image_bank/f7b9_shutterstock_1451794208.jpg)
