Tag: pypi
-
DeepSeek’s popularity exploited to push malicious packages via PyPI
Two malicious packages leveraging the DeepSeek name have been published to the Python Package Index (PyPI) package repository, and in the 30 minutes or so they were up, they … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/02/03/deepseeks-popularity-exploited-to-push-malicious-packages-via-pypi/
-
PyPI Introduces Archival Status to Alert Users About Unmaintained Python Packages
The maintainers of the Python Package Index (PyPI) registry have announced a new feature that allows package developers to archive a project as part of efforts to improve supply chain security.”Maintainers can now archive a project to let users know that the project is not expected to receive any more updates,” Facundo Tuesca, senior engineer…
-
PyPI adds project archiving system to stop malicious updates
The Python Package Index (PyPI) has announced the introduction of ‘Project Archival,’ a new system that allows publishers to archive their projects, indicating to the users that no updates are to be expected. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/pypi-adds-project-archiving-system-to-stop-malicious-updates/
-
Breach Roundup: Researchers Find Flaws in Palo Alto Firewalls
Also: US Prosecutors Charge Suspected North Korean IT Worker Collaborators. This week, researchers spied Palo Alto firewall flaws, a North Korean IT worker conspiracy, ChatGPT as DDoS vector. Chinese hackers targeted a VPN maker, a fake PyPi package and a Russian threat actor shifted tactics. BreachForums admin faces prison and scammers used the release of…
-
Python administrator moves to improve software security
The administrators of the Python Package Index (PyPI) have begun an effort to improve the hundreds of thousands of software packages that are listed. The attempt, which began earlier last year, is to identify and stop malware-laced packages from proliferating across the open-source community that contributes and consumes Python software. As previously reported, hijacking Python…
-
Malicious npm and PyPI target Solana Private keys to steal funds from victims’ wallets
Researchers found malicious npm and PyPI packages capable of stealing and deleting sensitive data from infected systems. Socket researchers have identified multiple packages in the npm and Python Package Index (PyPI) repository designed to target Solana private keys and drain funds from victims’ wallets. The malicious npm packages allowed the threat actors to exfiltrate Solana…
-
Hackers Weaponize Security Testing By Weaponizing npm, PyPI, Ruby Exploit Packages
Over the past year, malicious actors have been abusing OAST services for data exfiltration, C2 channel establishment, and multi-stage attacks by leveraging compromised JavaScript, Python, and Ruby packages. OAST tools, initially designed for ethical researchers to perform network interactions, can also be exploited by threat actors for malicious purposes such as data exfiltration and pivot…
-
Beware of New Malicious PyPI packages That Steals Login Details
Two malicious Python packages, Zebo-0.1.0 and Cometlogger-0.1, were recently detected by Fortinet’s AI-driven OSS malware detection system. These packages, spotted on November 16 and November 24, 2024, respectively, represent significant threats to users by leveraging advanced malware techniques. These findings underscore the critical importance of robust cybersecurity measures to protect against such sophisticated threats. Malicious…
-
Researchers Uncover PyPI Packages Stealing Keystrokes and Hijacking Social Accounts
Cybersecurity researchers have flagged two malicious packages that were uploaded to the Python Package Index (PyPI) repository and came fitted with capabilities to exfiltrate sensitive information from compromised hosts, according to new findings from Fortinet FortiGuard Labs.The packages, named zebo and cometlogger, attracted 118 and 164 downloads each, prior to them being taken down. First…
-
Compromised AI Library Delivers Cryptocurrency Miner via PyPI
The compromised ultralytics AI library delivered XMRig miner via GitHub Actions exploit First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ai-library-delivers-cryptocurrency/
-
Ultralytics AI Library Compromised: Cryptocurrency Miner Found in PyPI Versions
In yet another software supply chain attack, it has come to light that two versions of a popular Python artificial intelligence (AI) library named ultralytics were compromised to deliver a cryptocurrency miner.The versions, 8.3.41 and 8.3.42, have since been removed from the Python Package Index (PyPI) repository. A subsequently released version has introduced a security…
-
Supply chain compromise of Ultralytics AI library results in trojanized versions
Attackers have compromised Ultralytics YOLO packages published on PyPI, the official Python package index, by compromising the build environment of the popular library for creating custom machine learning models. The malicious code deployed cryptocurrency mining malware on systems that installed the package, but the attackers could have delivered any type of malware.According to researchers from…
-
Beware Of Malicious PyPI Packages That Inject infostealer Malware
Recent research uncovered a novel crypto-jacking attack targeting the Python Package Index (PyPI), where malicious actors uploaded a legitimate-seeming cryptocurrency client package, >>aiocpa,
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 22
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape. A Case-Control Study to Measure Behavioral Risks of Malware Encounters in Organizations PyPI Python Library >>aiocpa
-
Check Point entdeckt Typosquatting-Kampagne über PyPI
Für Sicherheitskräfte ist es wichtig, auf das inhärente Risiko hinzuweisen, das mit Open-Source-Komponenten verbunden ist, auch angesichts der zunehme… First seen on infopoint-security.de Jump to article: www.infopoint-security.de/check-point-entdeckt-typosquatting-kampagne-ueber-pypi/a36934/
-
Ein faules Potpourri aus Python-Paketen in PyPI
Tags: pypiFirst seen on welivesecurity.com Jump to article: www.welivesecurity.com/de/eset-research/ein-faules-potpourri-aus-python-paketen-in-pypi/
-
The Hidden Dangers in Open Source Libraries: A Closer Look at the Malicious Go Binary Hidden in a PyPI Package
First seen on thefinalhop.com Jump to article: www.thefinalhop.com/the-hidden-dangers-in-open-source-libraries-a-closer-look-at-the-malicious-go-binary-hidden-in-a-pypi-package/
-
Cybersecurity Alert: MUT-8694 Supply Chain Attack Targets npm and PyPI Ecosystems
The open-source ecosystem has once again become the battleground for cybercriminals, as Datadog’s Security Research team uncovered a coordinated supply chain attack by an enigmatic threat actor designated MUT-8694. Leveraging... First seen on securityonline.info Jump to article: securityonline.info/cybersecurity-alert-mut-8694-supply-chain-attack-targets-npm-and-pypi-ecosystems/
-
Telegram leveraged by updated PyPI package for crypto exfiltration
First seen on scworld.com Jump to article: www.scworld.com/brief/telegram-leveraged-by-updated-pypi-package-for-crypto-exfiltration
-
PyPI Python Library “aiocpa” Found Exfiltrating Crypto Keys via Telegram Bot
The administrators of the Python Package Index (PyPI) repository have quarantined the package “aiocpa” following a new update that included malicious code to exfiltrate private keys via Telegram.The package in question is described as a synchronous and asynchronous Crypto Pay API client. The package, originally released in September 2024, has been downloaded 12,100 times to…
-
Fake ChatGPT, Claude PyPI packages spread JarkaStealer malware
First seen on scworld.com Jump to article: www.scworld.com/news/fake-chatgpt-claude-pypi-packages-spread-jarkastealer-malware
-
PyPI-Lieferkette im Visier: Kaspersky deckte Cyber-Angriff auf
First seen on datensicherheit.de Jump to article: www.datensicherheit.de/pypi-lieferkette-visier-kaspersky-aufdeckung-cyber-angriff
-
PyPI Attack: ChatGPT, Claude Impersonators Deliver JarkaStealer via Python Libraries
Cybersecurity researchers have discovered two malicious packages uploaded to the Python Package Index (PyPI) repository that impersonated popular artificial intelligence (AI) models like OpenAI ChatGPT and Anthropic Claude to deliver an information stealer called JarkaStealer.The packages, named gptplus and claudeai-eng, were uploaded by a user named “Xeroline” in November 2023, attracting First seen on thehackernews.com…
-
Two PyPi Malicious Package Mimic ChatGPT Claude Steals Developers Data
Two malicious Python packages masquerading as tools for interacting with popular AI models ChatGPT and Claude were recently discovered on the Python Package Index (PyPI), the official repository for Python libraries. These packages reportedly remained undetected for over a year, silently compromising developer environments and exfiltrating sensitive data. As reported by a cybersecurity researcher, Leonid…
-
Attestations: A new generation of signatures on PyPI
Tags: pypiRead the official announcement on the PyPI blog as well! For the past year, we’ve worked with the Python Package Index (PyPI) on a new security feature for the Python ecosystem: index-hosted digital attestations, as specified in PEP 740. These attestations improve on traditional PGP signatures (which have been disabled on PyPI) by providing key……
-
Malicious Python Package Exfiltrates AWS Credentials
Developers’ Credentials Stolen via Typosquatted ‘Fabric’ Library. A malicious Python package that mimics a popular SSH automation library has been live on PyPi since 2021 and delivers payloads that steal credentials and create backdoors. The package steals AWS access and secret keys, sending them to a remote server operated through a VPN in Paris First…
-
Malicious PyPI package with 37,000 downloads steals AWS keys
A malicious Python package named ‘fabrice’ has been present in the Python Package Index (PyPI) since 2021, stealing Amazon Web Services credentials from unsuspecting developers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/malicious-pypi-package-with-37-000-downloads-steals-aws-keys/
-
Fabrice Malware on PyPI Has Been Stealing AWS Credentials for 3 Years
The malicious Python package >>Fabrice>Fabric