New Malware: Python Crypto & Dependency Confusion Packages

This Week in Malware - Python Cryptominers, 345 Dependency Confusion Packages

July 01, 2022
By Ax Sharma

17 minute read time

This week in malware, highlights include an influx of hundreds of dependency confusion packages with diverse targets and a 'python-dateutils' PyPI package that attempts to typosquat the vastly known Python module, dateutil.

python-dateutils Cryptominer Targets Windows, Linux, MacOS

You've probably heard of the Python module ' dateutil'. The module offers powerful extensions to the standard datetime library; extensively used by Python developers. This week, however, Sonatype's automated malware detection system caught a suspicious PyPI package called 'python-dateutils' that mines Monero (XMR) cryptocurrency on your system — whether Windows, Linux, or MacOS, and steals AWS credentials.

There is also some indication that in the past 'python-dateutils' could have been a legitimate library used by developers [ 1, 2 ]. But, versions of 'python-dateutils' caught by us this week are malicious.

Check out the detailed analysis in the dedicated blog post.

345+ Dependency Confusion Packages Caught

This week's findings involving dependency confusion candidates (npm and PyPI) include upwards of 345 packages:

Sonatype Firewall Users Remain Protected

This discovery follows our earlier report of several dozen malicious packages including npm package 'flame-vali' that attempted to disable Windows Defender multiple times before dropping a Trojan.

Sonatype remains at the forefront of timely discoveries and reporting attacks targeting OSS developers, like the ones discussed above.

Users of Sonatype Firewall can rest easy knowing that such malicious packages would automatically be blocked from reaching their development builds.

Sonatype Firewall instances will automatically quarantine any suspicious components detected by our automated malware detection systems while a manual review by a researcher is in the works, thereby keeping your software supply chain protected from the start.

Sonatype's world-class security research data, combined with our automated malware detection technology safeguards your developers, customers, and software supply chain from infections.

Written by Ax Sharma
Ax is a security researcher, malware analyst and journalist with a penchant for open source software. His works and expert analyses have frequently been featured by leading media outlets including the BBC. Ax's expertise lies in security vulnerability research, reverse engineering, and cybercrime investigations. He has a passion for educating a wide range of audiences through writing and vlogs.