Inside of the WASP's nest: deep dive into PyPI-hosted malware

[harlan4096]

In late 2022 we decided to start monitoring PyPI, arguably the most important Python repository, as there were a number of reports on it hosting malware. PyPI took exceptional relevance amongst all repositories as, historically, it was trusted by default by many software developers. Any security breach or abuse could lead to a large-scale Supply Chain attack.
 
During our monitoring we were able to identify dozens of suspicious packages, allegedly uploaded by threat actors trying to abuse PyPI. In some cases, attackers poisoned well-known legitimate Python libraries and reuploaded them leveraging typosquatting, such as "pylOpenSSL" mimicking pyOpenSSL. In other cases, they uploaded completely fake packages consisting only of malicious code, such as the scappy library.
 
Generally speaking, the main target of these attacks appears to be the victim's environment data with a focus on browser’s cookies. In some cases, malicious libraries implemented quite original features, like hijacking crypto wallet addresses in the victim’s clipboard.

In this post we will share insights on PyPi’s suspicious libraries as well as take a closer look at particular campaigns abusing it.

Statistic analysis

We observed that VirusTotal’s historical visibility on PyPi’s packages was far from ideal. Our monitoring system, aimed at fixing this blindspot, analyzed in a few days more packages than VirusTotal’s PyPi historical data.
 


We spotted an early batch of suspicious packages, detected by at least one AntiVirus vendor, and confirmed malicious after further detailed analysis. The following chart compares analyzed samples with suspicious ones (detected by at least one AntiVirus) . Please note that this chart uses raw data before additional analysis, meaning it includes both False Positives and False Negatives.



The manual analysis of dozens of malicious files gave us the impression that AntiVirus detection was initially low but it improved as details on malware abusing PyPI became publicly available, increasing awareness. This trend is visible in the following chart where every dot represents the daily average detection ratio for suspicious PyPi packages.
...

Continue Reading