ReversingLabs researchers found a number of malicious libraries in the Python Package Index (PyPI) repository.
Most of the files discovered were malicious packages masquerading as HTTP libraries, according to an advisory released Wednesday by Lucija Valentic, a software threat researcher at ReversingLabs.
“The descriptions of these packages are mostly not malicious,” explains Valentic. “Some are masquerading as real libraries, and compliment their features with those of known legitimate HTTP libraries.”
Specifically, ReversingLabs found 41 malicious PyPI packages, which security researchers categorized into two types.
The first was a download used to deliver second stage malware to compromised systems and the second was an information stealer.
“It’s not uncommon for malicious actors to call out the acronym ‘HTTP’ when naming malicious packages,” Valentic said.
She explained that developers often use HTTP libraries to communicate with appropriate APIs for third-party module functionality.
“This background makes HTTP libraries of great interest to malicious actors and researchers tracking malicious campaigns online,” wrote the security researcher.
Valentic says there are many similarities between the malicious packages ReversingLabs has detected.
“The packages contain only a few files and have little identifying information compared to legitimate software modules,” she wrote in the advisory.
“The functions and purposes contained in these packages are fictitious. The real purpose of these packages is malicious and unexplained.”
A list of these malicious packages and detailed descriptions of some of them are available at ReversingLabs. Recommendation.
“Typosquatting attacks against platforms such as PyPI, npm, RubyGems, and GitHub are common,” warns Valentic.
“Developers should frequently conduct security assessments of third-party libraries and other dependencies in their code.”
This technical article comes a few days after JavaScript developer Jesse Mitchell discovered the attacker. Uploaded over 15,000 spam packages on the open source npm repository.
