Malicious code in multyproccess (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7938a109a642dfe8b161e9568d6373a038c3413c0fd1f2b01702f4f173348553 The package's setup.py overrides the install and develop cmdclass to base64-decode a bundled request/.payload file and launch it via...

Malicious code in textwrap-formatter (PyPI)

Source: kam193 18da24e92fd40457ad3df2af568c07d41b35f44e6e07e8fac3bf0eafba9c2154 During installation, obfuscated code exfiltrates cryptocurrency wallet data to a hardcoded location and places a backdoor through a new authorized SSH key. Information about the placed backdoor is sent back to the...

Malicious code in pyfernet (PyPI)

Source: kam193 5a2f90c0e3c6e46456cd3e319aaaf4a7b53475a554a997a964fdda898e85fcd0 If imported, the module starts a multi-stage infostealer, exfiltrating browser data as well as crypto wallets, and also attempts to monitor clipboard looking for crypto wallets addresses --- Category: MALICIOUS - The...

GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure

CrowdStrike, in partnership with Google and the Shadowserver Foundation, has announced the simultaneous disruption of all command-and-control C2 channels associated with GlassWorm, a persistent software chain campaign targeting software developers through malicious packages and extensions. "Since...