Phylum Discovers Dozens More PyPI Packages Attempting to Deliver W4SP Stealer
upstart writes:
We have covered similar stories recently also involving the Python repository but I have chosen this one because it goes into considerable detail to explain exactly how the malware works and the tricks that the writers had to employ in an effort to avoid detection. I will admit that I would have missed some of them! See the linked source for all the dirty details.
Last week, our automated risk detection platform alerted us to some suspicious activity in dozens of newly published PyPI packages. It appears that these packages are a more sophisticated attempt to deliver the W4SP Stealer on to Python developer's machines by hiding a malicious __import__ . Join us here on the Phylum research team as we investigate these new and shifting tactics the attacker is using to deploy W4SP stealer in this supply-chain attack.
Similar to this attacker's previous attempts, this particular attack starts by copying existing popular libraries and simply injecting a malicious __import__ statement into an otherwise healthy codebase. The benefit this attacker gained from copying an existing legitimate package, is that because the PyPI landing page for the package is generated from the setup.py and the README.md, they immediately have a real looking landing page with mostly working links and the whole bit. Unless thoroughly inspected, a brief glance might lead one to believe this is also a legitimate package.
[...] Here's the PyPI landing page for the malicious package typesutil. You can see the attacker just copied the datetime2 package and made a few slight modifications in an effort to make the text consistent with the phony package name it was published under.
The main attack seems to have started around October 12, 2022, slowly picking up steam to a concentrated effort around October 22. Our system did, however, detect a small number of packages from July of 2022 that show similar IOC's. The assumption is that this was an early POC effort, that is just now being executed in this fashion.
[...] In the majority of packages, especially the earlier ones, the malicious import was simply injected into either the setup.py or the __init__.py as shown below on line 40.
Read more of this story at SoylentNews.