Skip to content

MALICIOUS (1) package from Python Package Index.

  1. The campaign has clearly malicious intent, like infostealers.

bq-helix-build-hook-6ade983e

Affected versions: (1) 0.1.0

  1. Version numbers are usually added automatically. In most cases, the packages listed here were created only to distribute malicious code.

During installation the code collects information from the environment, including credential files, environment variables, data from cloud metadata endpoints, and finally exfiltrates them.

Campaign data

Campaign information may not always be 100% accurate for every related package.

Campaign description

Package places PTH/sitecustomize files triggering execution of malicious code on every Python startup. The code then collects information from the environment, including credential files, environment variables, data from cloud metadata endpoints, and finally exfiltrates them.

See more details on the campaign page.

abuses-pth

The package uses .pth files, sitecustomize or usercustomize modules to execute malicious code during Python startup, even without importing the package code manually.

exfiltration_cloud_tokens

Campaign targets exfiltration_cloud_tokens.

exfiltration_credentials

The package attempts to steal credentials, like passwords or API keys.

exfiltration_env_variables

Campaign targets exfiltration_env_variables.

exfiltration_generic

Campaign targets exfiltration_generic.

Look up in other services

  1. May not be available. See more in pypi-json-data repository.
  2. Open Source Insights project, provided by Google.
  3. Service from Socket.dev, a cybersecurity company.
  4. Spectra Assure Community, a service from ReversingLabs, a cybersecurity company.
  5. Service from Snyk, a cybersecurity company.
  6. Service from Aikido Security, a cybersecurity company. May require login.