3 PyPI packages discovered spreading malware to developers systems
A threat actor known as Lolip0p has uploaded three rogue packages to the Python Package Index (PyPI) repository, which are designed to drop malware on compromised developer systems.
According to a report by Fortinet the packages, named colorslib, httpslib and libhttps, were uploaded by the author between January 7 and January 12, 2023, and have since been removed from the PyPI repository, but not before they were cumulatively downloaded over 550 times.
The modules come with identical setup scripts that are designed to invoke PowerShell and run a malicious binary (“Oxzy.exe”) hosted on Dropbox, which once launched, triggers the retrieval of a next-stage, also a binary named update.exe, that runs in the Windows temporary folder.
The executable update.exe is flagged by antivirus vendors as an information stealer that’s also capable of dropping additional binaries, one of which is detected by Microsoft as Wacatac.