Trojanized PyPI Packages

What are Trojanized PyPI Packages?

Trojanized PyPI packages are malicious packages that are uploaded to the PyPI repository by attackers who impersonate legitimate package maintainers. These packages are designed to mimic popular and widely used Python libraries, such as requests, numpy, pandas, and others. These malicious packages often have names similar to their legitimate counterparts, such as "reqeusts" instead of "requests", or "nummpy" instead of "numpy".

Once installed, these packages can execute various malicious activities, such as stealing user credentials, injecting malicious code, or performing unauthorized actions on the victim's system. The most common method used by attackers to distribute these packages is by creating fake accounts on PyPI or hijacking the accounts of legitimate package maintainers.

Recent Examples of Trojanized PyPI Packages

One of the most notable examples of Trojanized PyPI packages was the incident involving the popular library "colourama". In November 2019, an attacker uploaded a malicious version of this library to PyPI, which was downloaded more than 55,000 times before it was discovered and removed. The malicious version of the library contained a backdoor that allowed the attacker to execute arbitrary code on the victim's system.

Another recent example is the "python3-dateutil" package, which is a widely used library for working with dates and times in Python. In November 2020, a malicious version of this library was uploaded to PyPI, which contained a cryptocurrency-mining script that used the victim's system resources to mine Monero coins.

Recently, 41 malicious PyPI packages have been found to pose as typosquatted variants of legitimate modules such as HTTP, AIOHTTP, requests, urllib, and urllib3. The names of these packages are as follows:

aio5, aio6, htps1, httiop, httops, httplat, httpscolor, httpsing, httpslib, httpsos, httpsp, httpssp, httpssus, httpsus, httpxgetter, httpxmodifier, httpxrequester, httpxrequesterv2, httpxv2, httpxv3, libhttps, piphttps, pohttp, requestsd, requestse, requestst, ulrlib3, urelib3, urklib3, urlkib3, urllb, urllib33, urolib3, and xhttpsp.

Preventing Trojanized PyPI Packages

To prevent Trojanized PyPI packages from being installed, developers and users can take several precautions. One of the most important steps is to always verify the authenticity of the package before installing it. This can be done by checking the package's name and version number against the legitimate version on the official repository or by checking the package's hash against the one provided by the package maintainer.

Another step is to avoid using unofficial repositories or downloading packages from untrusted sources. Developers should always use PyPI's official repository or a trusted mirror for downloading packages. They should also use virtual environments to isolate their development environment and prevent unauthorized access to their system.

Conclusion

Trojanized PyPI packages are a growing threat to the Python development community, and their popularity is increasing among attackers. As developers, we must remain vigilant and take the necessary precautions to prevent these malicious packages from infecting our systems. We should always verify the authenticity of the packages we download and avoid using unofficial repositories or downloading packages from untrusted sources. By following these best practices, we can help keep our development environments and systems safe from the threat of Trojanized PyPI packages.