The Python security team removed two tainted Python libraries from PyPI (Python Package Index) that were found stealing SSH and GPG keys from the projects of infected developers.
Both libraries, “python3-dateutil” and “jeIlyfish,” were developed by the same developer (“olgired2017″) and have names similar to the ones of legitimate apps.
The name python3-dateutil imitated the popular “dateutil” library, while “jeIlyfish” (the first L is an I) imitated the “jellyfish” library.
The expert discovered the two libraries on December 1, by the German software developer Lukas Martini.
“Just a quick heads-up: There is a fake version of this package called python3-dateutil on PyPI that contains additional imports of the jeIlyfish package (itself a fake version of the jellyfish package, that first L is an I). That package in turn contains malicious code starting at line 313 in jeIlyfish/_jellyfish.py:” wrote Martini.
The “python3-dateutil” library was created and uploaded on PyPI on November 29, the “jeIlyfish” was uploaded on December 11, 2018, nearly one year ago.
The experts removed the two libraries the same day Martini reported his discovery to dateutil developers and the PyPI security team.
The jeIlyfish library contanins a malicious code, while the “python3-dateutil” library didn’t contain malicious code, but it was found importing the jeIlyfish library.
The tainted library attempts to exfiltrate SSH and GPG keys from the victim’s computer and send them to a server having IP address 68.183.212.246 at the port 32258.
Developers that used any of the two tainted libraries have to change all their SSH and GPG keys used since Decembre 2018.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Python libraries, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Google addressed a critical Chrome vulnerability, tracked as CVE-2024-4058, that resides in the ANGLE graphics…
Nation-state actor UAT4356 has been exploiting two zero-days in ASA and FTD firewalls since November…
A malware campaign has been exploiting the updating mechanism of the eScan antivirus to distribute…
The Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned four Iranian nationals for their…
A cyber attack on Leicester City Council resulted in certain street lights remaining illuminated all…
The National Police Agency in South Korea warns that North Korea-linked threat actors are targeting…
This website uses cookies.