Poisoned Pipeline / Incidents / AS186
PyPI typosquats (passlib, fabric, cookie lib, AnyDesk, Deezer, Instagram)
Socket PyPI posts: passlib and fabric SSH-library typosquats, browser-cookie
library mimic, AnyDesk/Malcom package, Deezer API abuse, Instagram
growth-tool harvester, TikTok/Instagram checker probes, crytic-compilers trojan.
Mapped techniques
- T0129 Typosquatting
- T0109 Publish malicious artifact
- T0184 Harvesting sensitive information from files
supply-chain campaign
Popular PyPI names.
Multiple packages.
Creds and tokens.
Sources
- https://socket.dev/blog/malicious-python-package-typosquats-popular-passlib-library
- https://socket.dev/blog/malicious-python-package-typosquats-fabric-ssh-library
- https://socket.dev/blog/typosquatting-on-pypi-malicious-package-mimics-popular-browser-cookie-library
- https://socket.dev/blog/unveiling-the-dangers-of-the-anydesk-malcom-malicious-python-package
- https://socket.dev/blog/malicious-pypi-package-exploits-deezer-api-for-coordinated-music-piracy
- https://socket.dev/blog/pypi-package-disguised-as-instagram-growth-tool-harvests-user-credentials
- https://socket.dev/blog/malicious-checker-packages-on-pypi-probe-tiktok-and-instagram
- https://socket.dev/blog/trojan-embedded-in-crytic-compilers-python-package