New Typosquats in PyPI, Dependency Confusion Packages

This Week in Malware - Typosquats in PyPI, Dependency Confusion Packages

August 04, 2022
By Hernán Ortiz

This week in malware, we discovered 50 packages that are either malicious or dependency confusion attacks.

Here's a list for reference:

Ransomware Scripts in PyPI

Three of the listed packages are typosquatting attacks in Python. In this case, the attacker mimics the name of a widely known library called 'Requests', expecting developers will accidentally download the malicious packages instead of the legitimate ones. If you're a developer and don't type the correct name, there's a possibility that you end up downloading packages that contain ransomware scripts.

Read our blog post for more details.

For reference, here are the names of the malicious packages:

Sonatype's automated malware detection system, which is offered as part of Sonatype Platform products, including Sonatype Firewall, helped us discover these packages.

Turn on Sonatype Firewall for Automatic Protection

As a DevSecOps organization, we remain committed to identifying and halting attacks against open source developers and the wider software supply chain, like the ones discussed above.

Users of Sonatype Firewall can rest easy knowing that such malicious packages would automatically be blocked from reaching their development builds.

Written by Hernán Ortiz
Tags: vulnerabilities, PyPI, malware prevention, DevZone, This Week in Malware, Sonatype Firewall