Cybersecurity researchers at Check Point Research (CPR) have discovered a new malicious package in PyPI, a code repository for the Python programming language that uses an image to deliver Trojan malware, primarily using GitHub.
The actors behind this new campaign hope that Python developers will sooner or later come across “apicolor” when searching for legitimate projects on the web.
Seemingly a benign package under development on PyPI, once installed, it first manually installs additional requirements, then downloads the image from the web. Additional requirements process the image and trigger the processing of the generated output with the exec command.
Steganographic attack
One of these two requirements is the judyb code, which is actually a steganographic module capable of revealing hidden messages in images. This led the researchers back to the image, which appears to be downloading malicious packets from the network to the victim’s endpoint (opens in a new tab).
“The closest place to investigate such packages is GitHub,” the researchers explain. “Researchers looked for code designs using these packages, allowing the team to further understand their infection techniques (whether someone installed them by mistake, and if so, how). Using this search, it became clear that apicolor and judib are quite niche and have low usage in GitHub projects.”
As soon as CPR notified PyPI of its findings, the latter removed the malicious package from its platform.
While the researchers did not know who was behind this campaign, they said the entire trial was “carefully planned and thought out,” further stating that PyPI’s obfuscation techniques have evolved.
“We constantly scan PyPI for malicious packages and responsibly report them to PyPI. This one is unique and different from almost all malicious packages we’ve come across before,” commented Ori Abramovsky, Head of Data Science, SpectralOps, Check Point.
“This package differs in the way it camouflages its intentions and the way it targets PyPI users to infect them with a malicious import from GitHub. Our findings indicate that malicious PyPI packages and their obfuscation techniques are rapidly evolving. The package we have shared here reflects careful and meticulous work. This is not the usual copy and past that we usually see, but something that feels like a real campaign. Creating GitHub projects and then cleverly hiding code and downplaying packages in PyPI is sophisticated work.”