PyPI Halts New User Registrations to Combat Malware Campaign

The Python Package Index (PyPI) has implemented a temporary halt on user registrations and the creation of new projects due to an ongoing malware scheme. PyPI serves as a central hub for Python projects, aiding developers in discovering and installing Python packages.

With a vast array of packages available, PyPI becomes an attractive target for malicious actors who often upload counterfeit or fraudulent packages, posing risks to software developers and potentially initiating supply-chain attacks. Consequently, PyPI administrators recently announced the suspension of new user registrations to address this malicious activity.

According to a report by Checkmarx, cyber threat actors began uploading 365 packages to PyPI, masquerading as legitimate projects. These packages contain malicious code within their ‘setup.py’ files, which triggers upon installation, attempting to retrieve additional harmful payloads from remote servers.

To avoid detection, the malicious code encrypts using the Fernet module, with the remote server’s URL dynamically generated as required. The ultimate payload includes an information-stealing mechanism with persistent capabilities, targeting data stored in web browsers such as login credentials, cookies, and cryptocurrency extensions.

Checkmarx has published a comprehensive list of identified malicious entries, featuring nume

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.