Top insights for IT pros
From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.
Want some good life advice? Don’t blindly trust strangers, and avoid downloading random packages.
That might sound like obvious advice, but a malicious Python Package Index (PyPI) package was downloaded at least 264 times practically overnight after a suspicious user on coding forum Stack Overflow advertised it as a solution to unrelated problems, according to security firm Sonatype.
Sonatype’s Ax Sharma said the malware is called “pytoileur,” mimicking the common shorthand format for various Python tools, and describes itself in metadata and on its HTML webpage description merely as a “cool package” and an “API management tool written in Python.” The account that uploaded the package to PyPI, “PhilipsPY,” has existed only since May 25, with pytoileur its only contribution.
Analysis of the package showed its setup file contained a hidden line executing a base64-encoded payload—which wouldn’t be suspicious in and of itself had the author not tried to hide it, or if the payload wasn’t a malicious executable, Sonatype researcher Jeff Thornhill noted.
In addition to modifying Windows registry values and deploying spyware, the package contained “a malicious PyPI package hiding code that downloads and installs trojanized Windows binaries capable of surveillance, achieving persistence, and crypto-theft” targeting common web browsers and cryptocurrency services. Sonatype further discovered another days-old account on Stack Overflow which had responded to unrelated questions at least three times with instructions on how to install and run pytoileur, and reported that there were numerous similarities with other malicious packages found on PyPI in 2023.
Abuse of open-source community repositories and forums is both common and difficult for operators to prevent without compromising their ethos. The technique is so widespread that cybersecurity firm Recorded Future gave it the moniker “living-off-trusted-sites” (LOTS) earlier this year.
In March, application security firm Checkmarx found attackers typosquatting on a URL similar to the official Python mirror, using it to distribute malware. PyPI had implemented mandatory two-factor authentication for all publishers in 2023 to guard against account theft following a wave of malicious uploads (as have some other code platforms, such as GitHub).
“We can only hope developers will use their best judgment and not fall for this trap!” Sharma wrote.