MAL-2023-8366

Dashboard / Malicious Package / MAL-2023-8366

MAL-2023-8366

Summary: Malicious code in python-aliyun-sdk-kms (PyPI)

Details: Source: checkmarx (53bdcdc5414f25435cd821a9217982c4b486c91100caa324a9c3613d4ccd8d42) Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security (4b0a37d9408528e981948fc9fa594b68b02980adbd851742fd03422ff814a7d7) Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategicly chosen functions and would only trigger when these functions were called. The malicious code does not automatically run on install or import, helping the packages evade detection.

References: https://checkmarx.com/blog/users-of-telegram-aws-and-alibaba-cloud-targeted-in-latest-supply-chain-attack/, https://medium.com/checkmarx-security/users-of-telegram-aws-and-alibaba-cloud-targeted-in-latest-supply-chain-attack-f44e60eacbdd