- Scientists found three malicious pypi -packs, two targeted bitcoin developers and a woocommerce shop
- Two is designed to steal data and the third that tests for valid credit card
- All three have since been removed from the depot
Several open source software packages on the Python Package Index (Pypi) room turned out to be malicious, which is likely to compromise thousands of devices, experts have warned.
CyberSecurity researchers at ReversingLabs found two malicious packages, “BitcoinLibdbfix” and “Bitcoinlib-Dev”, which cumulatively has about 2,000 downloads.
They claim to be a solution for a legitimate Python module called “Bitcoinlib”, which contains features for the creation and control of cryptocurrency.
WOOCOMMERCE stores under attack
Recently, society discussed a problem related to how the package generates error messages.
Crooks saw this as an opportunity, created the two malicious packages and jumped into the conversation in an attempt to distribute them. It doesn’t seem to have worked: “The malicious content of this library was discovered by the package contributors and the comments were deleted,” ReversingLabs said.
Both libraries tried a similar attack, the researchers explained further. The idea was to overwrite the legitimate ‘CLW CLI’ command with malicious code that exfiltrating sensitive database files.
At the same time, scientists from Socket found a third package that is not targeted at Bitcoin developers, but rather WOOCOMMERCE stores. Furthermore, this package does not even try to hide its true intentions and is instead “openly malicious”. Despite being obvious malware, it was still managed to rake 37,217 downloads.
Malware is called “Skillasya” and acts as a fully automatic card script. “The malicious payload was introduced in version 7.36.9, and all subsequent versions wore the same embedded attack logic,” Socket said.
Carding is a type of cybercrime where stolen credit card information is used to make unauthorized purchases or tests if the card is still active. As criminals often buy these card information from the dark web, the one who built and distributed Vildasya could have benefited greatly from it.
Via Hacker the news
