If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: checkmarx (c79d20c4af5b69c3506d69fb847d2f5306a83433cb56e391c8dbf828e9728319)
Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials
Source: google-open-source-security (1c2d7813ed56684da76968b382947f78dc954abf5a95371e9752325a8eae3f2c)
Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI.
The malicious code was hidden in strategicly chosen functions and would only trigger when these
functions were called. The malicious code does not automatically run on install or import,
helping the packages evade detection.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxp://119[.]8[.]26[.]163:58888/p/b66886/os11/ other packages →
- hxxps://api[.]aliyun-sdk-requests[.]xyz/tencent other packages →
- hxxps://tg[.]aliyun-sdk-requests[.]xyz/telegram other packages →
- hxxps://api[.]aliyun-sdk-requests[.]xyz/aws other packages →
- hxxps://api[.]aliyun-sdk-requests[.]xyz/aliyun other packages →
IP addresses
- 119[.]8[.]26[.]163 other packages →