The Python security team removed two tainted Python libraries from PyPI (Python Package Index) that were found stealing SSH and GPG keys from the projects of infected developers.
Both libraries, “python3-dateutil” and “jeIlyfish,” were developed by the same developer (“olgired2017″) and have names similar to the ones of legitimate apps.
The name python3-dateutil imitated the popular “dateutil” library, while “jeIlyfish” (the first L is an I) imitated the “jellyfish” library.
The expert discovered the two libraries on December 1, by the German software developer Lukas Martini.
“Just a quick heads-up: There is a fake version of this package called python3-dateutil on PyPI that contains additional imports of the jeIlyfish package (itself a fake version of the jellyfish package, that first L is an I). That package in turn contains malicious code starting at line 313 in jeIlyfish/_jellyfish.py:” wrote Martini.
The “python3-dateutil” library was created and uploaded on PyPI on November 29, the “jeIlyfish” was uploaded on December 11, 2018, nearly one year ago.
The experts removed the two libraries the same day Martini reported his discovery to dateutil developers and the PyPI security team.
The jeIlyfish library contanins a malicious code, while the “python3-dateutil” library didn’t contain malicious code, but it was found importing the jeIlyfish library.
The tainted library attempts to exfiltrate SSH and GPG keys from the victim’s computer and send them to a server having IP address 68.183.212.246 at the port 32258.
Developers that used any of the two tainted libraries have to change all their SSH and GPG keys used since Decembre 2018.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Python libraries, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows flaws to its Known Exploited…
Ivanti addressed two Endpoint Manager Mobile (EPMM) software vulnerabilities that have been exploited in limited…
Microsoft Patch Tuesday security updates for May 2025 addressed 75 security flaws across multiple products, including…
Fortinet fixed a critical remote code execution zero-day vulnerability actively exploited in attacks targeting FortiVoice…
Interlock Ransomware 's attack on a defense contractor exposed global defense supply chain details, risking…
Marks and Spencer (M&S) confirms that threat actors stole customer data in the ransomware attack…
This website uses cookies.
