Researchers Uncover PyPI Package Hiding Malicious Code Behind Image File

A destructive package deal learned on the Python Offer Index (PyPI) has been observed employing a steganographic trick to conceal destructive code in just impression files.

The deal in dilemma, named “apicolor,” was uploaded to the Python 3rd-party repository on Oct 31, 2022, and described as a “Core lib for Relaxation API,” according to Israeli cybersecurity organization Examine Point. It has considering the fact that been taken down.

Apicolor, like other rogue packages detected not long ago, harbors its malicious actions in the set up script utilized to specify metadata related with the deal, these types of as its dependencies.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

This takes the variety of a next deal referred to as “judyb” as very well as a seemingly harmless PNG file (“8F4D2uF.png”) hosted on Imgur, an picture-sharing assistance.

“The judyb code turned out to be a steganography module, responsible [for] hiding and revealing concealed messages inside images,” Examine Issue described.

The attack chain involves working with the judyb offer to extract obfuscated Python code embedded within just the downloaded image, which, upon decoding, is intended to retrieve and execute a malicious binary from a remote server.

The progress is portion of an ongoing pattern where by threat actors are more and more environment their sights on the open up resource ecosystem to exploit the have faith in involved with 3rd-party program to mount supply chain attacks.

Even much more troublingly, this kind of destructive libraries can be incorporated into other open up supply initiatives and printed on GitHub, efficiently broadening the scope and scale of the attacks.

“These conclusions reflect very careful planning and believed by a menace actor, who proves that obfuscation strategies on PyPI have evolved,” the organization said.

Discovered this report fascinating? Adhere to THN on Fb, Twitter  and LinkedIn to examine a lot more unique content material we submit.