The maintainers of the Python Package Index (PyPI), the official third-party software repository for the Python programming language, have temporarily disabled the ability for users to sign up and upload new packages until further notice.
“The amount of malicious users and malicious projects created on our index over the past week has outstripped our ability to respond in a timely manner, especially with multiple PyPI admins on vacation,” said the management. said in a notice published on May 20. , 2023.
No additional details regarding the nature of the malware and threat actors involved in publishing these malicious packages to PyPI have been disclosed.
The decision to freeze new user and project registrations has proven time and time again that software registries such as PyPI are popular targets for attackers seeking to compromise the developer environment by polluting the software supply chain. It was done while I was there.
Zero Trust + Deception: Learn How to Outsmart Attackers!
See how Deception can detect advanced threats, stop lateral movement, and strengthen your Zero Trust strategy. Join us for an insightful webinar!
Reserve your seat!
Earlier this week, Israeli cybersecurity startup Phylum used an OpenAI ChatGPT-themed decoy to lure developers into downloading malicious Python modules that steal clipboard content and hijack cryptocurrency transactions. Found an active malware campaign.
ReversingLabs made similar findings, identifying multiple npm packages named nodejs-encrypt-agent and nodejs-cookie-proxy-agent within npm repositories that dropped a Trojan called TurkoRat.
