Pierluigi Paganini December 04, 2019

The Python security team removed two trojanized Python libraries from PyPI (Python Package Index) that were stealing SSH and GPG keys from the projects of infected developers.

The Python security team removed two tainted Python libraries from PyPI (Python Package Index) that were found stealing SSH and GPG keys from the projects of infected developers.

Both libraries, “python3-dateutil” and “jeIlyfish,” were developed by the same developer (“olgired2017″) and have names similar to the ones of legitimate apps.

The name python3-dateutil imitated the popular “dateutil” library, while “jeIlyfish” (the first L is an I) imitated the “jellyfish” library.

The expert discovered the two libraries on December 1, by the German software developer Lukas Martini.

“Just a quick heads-up: There is a fake version of this package called python3-dateutil on PyPI that contains additional imports of the jeIlyfish package (itself a fake version of the jellyfish package, that first L is an I). That package in turn contains malicious code starting at line 313 in jeIlyfish/_jellyfish.py:” wrote Martini.

The “python3-dateutil” library was created and uploaded on PyPI on November 29, the “jeIlyfish” was uploaded on December 11, 2018, nearly one year ago.

The experts removed the two libraries the same day Martini reported his discovery to dateutil developers and the PyPI security team.

The jeIlyfish library contanins a malicious code, while the “python3-dateutil” library didn’t contain malicious code, but it was found importing the jeIlyfish library.

The tainted library attempts to exfiltrate SSH and GPG keys from the victim’s computer and send them to a server having IP address 68.183.212.246 at the port 32258.

Developers that used any of the two tainted libraries have to change all their SSH and GPG keys used since Decembre 2018.

Pierluigi Paganini

(SecurityAffairs – Python libraries, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]