Two Additional Malicious Python Libraries Found on PyPI Repository

Two more malicious Python packages have been discovered in the Python Package Index (PyPI) repository, days after security researchers from Check Point spotted 10 of them.

The two additional packages were also found, this time by Kaspersky, who posted an advisory describing them on their blog.

According to the security team, both new packages were masquerading as one of the most popular open-source packages on PyPI.

“The attacker used a description of the legitimate ‘requests’ package in order to trick victims into installing a malicious one,” wrote Kaspersky.

Additionally, the description contained faked statistics, suggesting the package was installed 230 million times in a month and had more than 48,000 “stars” on GitHub. 

“The project description also references the web pages of the original ‘requests’ package, as well as the author’s email,” Kaspersky said. “All mentions of the legitimate package’s name have been replaced with the name of the malicious one.”

The code of the malicious packages was also extremely similar to the code of the legitimate ‘requests’ package, except for one file called exception.py.

The modified version of the script (dated July 30, the date of publication of the malicious package), was responsible for delivering a malicious payload.

“The script writes another Python one-liner script into a temporary file and then runs that file via the system.start() function. Then that one-liner script downloads the next-stage script,” Kaspersky explained.

The next stage of the attack would then rely on a downloader obfuscated with a publicly available tool named Hyperion, which would deploy the final stage payload featuring a script allowing it to achieve persistence on the infected machine.

The final payload, dubbed “W4SP Stealer” by its author in the code, is a Trojan written in Python and obfuscated with the same obfuscator as the downloader. 

The malware can steal IP addresses, and work with cryptography for decrypting cookies and passwords from browsers. After initial infection, the Trojan starts collecting Discord tokens, saved cookies and passwords from browsers in separate threads.

“The injected script monitors the victim’s actions such, as changing their email address, password or billing information. The updated information is also sent to the Discord channel,” read the advisory.

Kaspersky ended the document by confirming it reported the two packages to both the PyPI security team and Snyk Vulnerability Database.

The discovery of the malicious packages comes weeks after PyPI announced it would start enforcing a mandatory two-factor authentication (2FA) policy for projects categorized as “critical.”