Malicious PyPI Packages Targeting Cloud Tokens: Over 14,100 Downloads Before Detection

TL;DR

• Malicious PyPI packages disguised as time-related utilities stole cloud tokens.
• Over 14,100 downloads occurred before detection and removal.
• Software supply chain security firm ReversingLabs identified 20 such packages.

Malicious PyPI Packages Targeting Cloud Tokens

Cybersecurity researchers have issued a warning about a malicious campaign targeting users of the Python Package Index (PyPI) repository. This campaign involved the use of bogus libraries masquerading as time-related utilities. These malicious packages harbored hidden functionality designed to steal sensitive data, including cloud access tokens¹.

The software supply chain security firm ReversingLabs reported discovering two sets of packages, totaling 20 malicious entities. These packages were designed to exploit the trust users place in the PyPI repository, leading to a significant security breach¹.

The campaign’s impact was substantial, with over 14,100 downloads before the packages were detected and removed. This highlights the growing threat of supply chain attacks in the software development ecosystem¹.

Conclusion

The detection of these malicious PyPI packages underscores the importance of vigilance in software supply chain security. As cyber threats continue to evolve, it is crucial for developers and users to remain informed and proactive in protecting their systems and data¹.

Additional Resources

For further insights, check:

• The Hacker News
• ReversingLabs

References

1. ReversingLabs (2023). “Malicious PyPI Packages Stole Cloud Tokens”. ReversingLabs. Retrieved 2025-03-15. ↩︎ ↩︎² ↩︎³ ↩︎⁴