In the Python package directory PyPI (Python Package Index) malicious packages "" and "" which were uploaded by a single author olgired2017 and disguised as popular packages "" and "" (distinguished by using the character "I" (i) instead of "l" (L) in the name). After installing the mentioned packages, encryption keys and user confidential data found in the system were sent to the intruder's server. Currently, the problematic packages have already been removed from the PyPI directory.
The malicious code was present in the package "jeIlyfish", while the package "python3-dateutil" used it as a dependency.
The names were chosen based on the assumption of inattentive users making typos while searching (). The malicious package "jeIlyfish" was uploaded about a year ago — on December 11, 2018, and remained unnoticed. The package "python3-dateutil" was uploaded on November 29, 2019, and after a few days raised suspicion from one of the developers. There is no information provided about the number of installations of the malicious packages.
The package jellyfish contained code that downloads a list of "hashes" from an external repository based on GitLab. Analyzing the logic of working with these "hashes" revealed that they contained a script encoded using base64 and executed after decoding. The script found SSH and GPG keys in the system, as well as certain types of files from the home directory and credentials for PyCharm projects, after which it sent them to an external server running in DigitalOcean's cloud infrastructure.
Source: opennet.ru
