The author of mitmproxy, a tool for analyzing HTTP/HTTPS traffic, noted the emergence in the Python Package Index (PyPI) of a fork of his project. The fork was distributed under a similar name, mitmproxy2, and a non-existent version 8.0.1 (the current release of mitmproxy is 7.0.4), with the expectation that inattentive users would perceive the package as a new edition of the main project (typosquatting) and would want to try out the new version.
In its composition, mitmproxy2 was akin to mitmproxy, except for modifications implementing malicious functionality. The changes involved the cessation of presenting the HTTP header 'X-Frame-Options: DENY', which prevents content from being processed within iframes, disabling protection against XSRF attacks, and setting the headers 'Access-Control-Allow-Origin: *', 'Access-Control-Allow-Headers: *', and 'Access-Control-Allow-Methods: POST, GET, DELETE, OPTIONS.'
These changes removed access restrictions to the HTTP API used to control mitmproxy via the web interface, which allowed any attacker on the same local network to execute their code on the user's system by sending an HTTP request.
The directory administration agreed that the changes made could be interpreted as malicious, and the package itself was an attempt to promote another product as if it were the main project (the package description claimed it was a new version of mitmproxy, not a fork). After the package was removed from the directory, the next day a new package, mitmproxy-iframe, was posted in PyPI, the description of which also completely matched the official package. The mitmproxy-iframe package has also been removed from the PyPI directory.
Source: opennet.ru
