In search of the Triangulation: triangle_check utility

In our initial blogpost about "Operation Triangulation", we published a comprehensive guide on how to manually check iOS device backups for possible indicators of compromise using MVT. This process takes time and requires manual search for several types of indicators. To automate this process, we...

Malicious PyPI Packages Using Compiled Python Code to Bypass Detection

Researchers have discovered a novel attack on the Python Package Index PyPI repository that employs compiled Python code to sidestep detection by application security tools. "It may be the first supply chain attack to take advantage of the fact that Python bytecode PYC files can be directly...

MAL-2023-2692 Malicious code in cxfreezepy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 98b9fe0f574ed33e0a4096ba8774936c73969493c1621244334a739ef4f94f5d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

PyPI Implements Mandatory Two-Factor Authentication for Project Owners

The Python Package Index PyPI announced last week that every account that maintains a project on the official third-party software repository will be required to turn on two-factor authentication 2FA by the end of the year. "Between now and the end of the year, PyPI will begin gating access to...

MAL-2023-8569 Malicious code in pyclack (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a5bbfd7bb3c6e08fcaab006836d25519f6f790a3e647e64dd210e0b6f464d490 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-4800 Malicious code in oculoushide (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9b7403cc73bb98e45396c93de766686608f4d7f80a03e6e8af73d244de0c7fe1 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-1420 Malicious code in this-is-malware (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a09f1ea3e612edb3afa0fb412d98d5c1ce03b4303b89288ce84357b49b25a3ac The OpenSSF Package Analysis project identified 'this-is-malware' @ 0.1.0 pypi as malicious. It is considered malicious because: - The package...

PyPI Repository Under Attack: User Sign-Ups and Package Uploads Temporarily Halted

The maintainers of Python Package Index PyPI, the official third-party software repository for the Python programming language, have temporarily disabled the ability for users to sign up and upload new packages until further notice. "The volume of malicious users and malicious projects being...

MAL-2023-1383 Malicious code in opencv-keras (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1f3dbc8704eb128ec656854e38ccd3c45d1232978eed378bb7711837dddd09bf The OpenSSF Package Analysis project identified 'opencv-keras' @ 17.10.13 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1414 Malicious code in sqlalchemy-os (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0e9079084215abb63a9468cc5ba89b5275afec40b081f77e9518498eb56a0c30 The OpenSSF Package Analysis project identified 'sqlalchemy-os' @ 14.0.10 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1399 Malicious code in req-flask (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a1a249da7f5d65ac080890111e76921348e8eadbfca48a449be1319f9c65982c The OpenSSF Package Analysis project identified 'req-flask' @ 2.9.4 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1384 Malicious code in os-numpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 40ad87c585abfe0e853406f3417eab643e74d78e36679be13bdc5445899d5397 The OpenSSF Package Analysis project identified 'os-numpy' @ 3.19.4 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1394 Malicious code in pylint-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3445cee4e2fd4e4e0170f04b51b2a3409af7c1b2478609a38bcc46d5094e134d The OpenSSF Package Analysis project identified 'pylint-py' @ 15.0.3 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1393 Malicious code in pylint-beautifulsoup (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c3646b7e949a863983491259c105cde8b1ff0229781276a5ea22360c75440c5e The OpenSSF Package Analysis project identified 'pylint-beautifulsoup' @ 3.12.3 pypi as malicious. It is considered malicious because: - The...

MAL-2023-1415 Malicious code in sqlalchemy-requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis be7d898e9281f3e8f393a19f3b1e4eece53fe128076fb65cc38c73116fc8de64 The OpenSSF Package Analysis project identified 'sqlalchemy-requests' @ 7.1.1 pypi as malicious. It is considered malicious because: - The packa...

Malicious code in matplotlib-req (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bd93a03dd511f9d7c410511963475b420e4509248f52573f9dbcb75147a43d8a The OpenSSF Package Analysis project identified 'matplotlib-req' @ 17.6.16 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1389 Malicious code in pygame-install (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 93390eea0977ef15ff0c7413e64df5bd99497ea76e9238097ee0b6f4b9862fdd The OpenSSF Package Analysis project identified 'pygame-install' @ 17.14.20 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1406 Malicious code in selenium-matplotlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c33741bca6736c936d2c0540044a5d38caf6a18b6981e6268da4295f64985a68 The OpenSSF Package Analysis project identified 'selenium-matplotlib' @ 17.9.4 pypi as malicious. It is considered malicious because: - The...

MAL-2023-1382 Malicious code in numpy-selenium (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dc92a371c845859241fd20b897b00c4b6c39fcc8ec83dfe9fbb0146c36d267c5 The OpenSSF Package Analysis project identified 'numpy-selenium' @ 5.20.19 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1391 Malicious code in pygame-pytorch (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c104a6d866e764da7907147cd7def349f360987498156433ef1e11bf4ac2263c The OpenSSF Package Analysis project identified 'pygame-pytorch' @ 3.4.19 pypi as malicious. It is considered malicious because: - The package...