Malicious library files found in PyPi Repository

Researchers have spotted numerous malicious packages on PyPI, the primary Python package index used by Python developers.

The first of them was Ascii2text, a malicious package that mimicked the popular art package by name and description. Ascii2text would work by downloading a script that gathered passwords stored in web browsers like Google Chrome, Microsoft Edge, Brave, Opera, and Yandex Browser.

In its advisory, it has mentioned Pyg-utils, Pymocks and PyProto2, three separate packages with the common goal of stealing users’ AWS credentials. The Test-async and Zlibsrc libraries also appear in the report. According to Check Point, both would download and execute potentially malicious code during installation.

An additional trio of malicious packages is mentioned by Check Point: Free-net-vpn, Free-net-vpn2, and WINRPCexploit – all of which are capable of stealing user credentials and environment variables.

Browserdiv, is a malicious package whose aim was to steal installers’ credentials by collecting and sending them to a predefined Discord webhook also covered in the advisory

Researchers reportedly alerted PyPI via their official website. Following the disclosure, PyPI removed these packages.

To reduce the presence of malicious packages on PyPI, the repository’s team started enforcing MFA policy for projects categorized as “critical” in July.

This research was done and documented by Checkpoint researchers