MAL-2023-8360

    Dashboard / Malicious Package / MAL-2023-8360

    MAL-2023-8360

    Published: 12 Sept 2023Last Modified: 16 Oct 2023

    Summary: Malicious code in enumerate-iam (PyPI)

    Details: Source: checkmarx (bfefcae6c29da10e63d630fc7e012995d730cc5c0af3a8144dc517f26382a3bd) Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security (cc5e304091eeb9848bd177dfd300a7df7778e3913b42af19741f6cddec4be752) Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategicly chosen functions and would only trigger when these functions were called. The malicious code does not automatically run on install or import, helping the packages evade detection.

    References: https://checkmarx.com/blog/users-of-telegram-aws-and-alibaba-cloud-targeted-in-latest-supply-chain-attack/, https://blog.phylum.io/cloud-provider-credentials-targeted-in-new-pypi-malware-campaign/, https://medium.com/checkmarx-security/users-of-telegram-aws-and-alibaba-cloud-targeted-in-latest-supply-chain-attack-f44e60eacbdd

    Affected packages

    Package

    Name: enumerate-iam

    Purl: pkg:pypi/enumerate-iam

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    MAL-2023-8360 | CVE-DB