Skip to content

MALICIOUS (1) package from Python Package Index.

  1. The campaign has clearly malicious intent, like infostealers.

hmacsync

Affected versions: (1) 1.0.0

  1. Version numbers are usually added automatically. In most cases, the packages listed here were created only to distribute malicious code.

The package is a new version of the previously removed libhmac. The key parts, a malicious payload to inject into hijacked browser extensions, is not included in the package. The code allows hijacking browser extensions to - based on previous package - exfiltrate credentials. This package also contains code to create hidden SSH access to the machine with hardcoded credentials.

Campaign data

Campaign information may not always be 100% accurate for every related package.

Campaign description

The package is a loader of an infostealer that modifies browser extensions to intercept credentials and cryptowallet data. The installation is not automatic, the code is intended to be triggered externally, but includes hardcoded exfiltration target.

See more details on the campaign page.

crypto-related

Malicious activity is related to cryptocurrencies or blockchain, e.g. stealing crypto wallets.

exfiltration_browser_data

Campaign targets exfiltration_browser_data.

exfiltration_credentials

The package attempts to steal credentials, like passwords or API keys.

exfiltration_crypto

The package attempts to steal sensitive cryptocurrency-related data, like wallet keys.

Look up in other services

  1. May not be available. See more in pypi-json-data repository.
  2. Open Source Insights project, provided by Google.
  3. Service from Socket.dev, a cybersecurity company.
  4. Spectra Assure Community, a service from ReversingLabs, a cybersecurity company.
  5. Service from Snyk, a cybersecurity company.