Tuesday, June 25, 2024

Malicious PyPI & NPM Packages Attacking MacOS Users

Cybersecurity researchers have identified a series of malicious software packages targeting MacOS users.

These packages, found on the Python Package Index (PyPI) and NPM, have been meticulously analyzed to uncover their malicious intent and sophisticated attack mechanisms.

GuardDog: The Sentinel Against Malicious Packages

In late 2022, a CLI-based tool named GuardDog was released. Utilizing Semgrep and package metadata heuristics, GuardDog identifies malicious software packages based on common patterns.

By early 2023, GuardDog was scaled to continuously scan PyPI, leading to the identification and manual triage of nearly 1,500 malicious packages.

According to SecurityLabs reports, this effort has resulted in one of the most enormous labeled datasets of malicious packages available to the public.GuardDog Dashboard

ANYRUN malware sandbox’s 8th Birthday Special Offer: Grab 6 Months of Free Service

Initial Lead: The “reallydonothing” Package

The initial lead came from a package named “reallydonothing,” published on May 9, 2024. This package exhibited several suspicious characteristics:

  • Empty description
  • Single Python file
  • Command overwrite
  • OS command execution

These indicators triggered GuardDog’s rules, prompting further investigation.

Detailed Analysis of Malicious Packages

The malicious packages, including “reallydonothing,” “jupyter-calendar-extension,” “calendar-extender,” “ReportGenPub,” and “Auto-Scrubber,” share a standard structure.

They consist of a single Python file, setup.py, which overwrites the setup command to execute malicious code upon installation.

Code Example:

class InstallCommand(install):
def run(self):
# malicious code follows

cmdclass={'install': InstallCommand},

The malicious code searches for specific file patterns on the local file system and uses hardcoded values to determine the presence of a secret file.

Further malicious actions are executed if the file is found, including downloading and running a second-stage binary.

How the Identified Malicious Packages Differ

The identified packages vary in file patterns, hardcoded values, and the locations where they drop binaries.

Here is a summary of the differences:

Package NameVersionFiles MatchedHardcoded Magic WordsPath of Dropped BinaryFile Created After Successful Infection
reallydonothing0.1/Library/Application Support/t*/O/*railroad, jewel, drown, archive~/.local/bin/donothing/tmp/testing
reallydonothing0.3/Library/Application Support/t*/O/*railroad, jewel, drown, archive~/.local/bin/donothing/tmp/testing
jupyter-calendar-extension0.1/Users/Shared/C*/r/2*/*craft, ribbon, effect, jacket~/.local/bin/jupyter_calendar/tmp/21cb7184-5e4e-4041-b6db-91688a974c56
calendar-extender0.1/Users/Shared/C*/r/2*/*craft, ribbon, effect, jacket~/.local/bin/calendar_extender/tmp/9bacc561-8485-4731-9c09-7eb4f3fae355
calendar-extender0.2/Users/Shared/C*/r/2*/*craft, ribbon, effect, jacket~/.local/bin/calendar_extender/tmp/21cb7184-5e4e-4041-b6db-91688a974c56
ReportGenPub0.1/Users/Shared/P*/c/R*/*bench, example, assume, reservoir~/.local/bin/report_genNone
ReportGenPub0.2/Users/Shared/P*/c/R*/*bench, example, assume, reservoir~/.local/bin/report_genNone
Auto-Scrubber0.1/Users/Shared/Videos/t/2*/*liberty, seed, novel, structure~/.local/bin/AutoScrubNone


These malicious packages specifically target MacOS systems, searching for files in standard directories like /Users/Shared and /Library/Application Support.

The attacker’s intentions remain obscure due to the use of one-way hashing functions and secret file paths, making it difficult to determine the payload URL without the secret file path.

The discovery of these malicious packages highlights the importance of continuously monitoring and analyzing software repositories.

Tools like GuardDog play a crucial role in identifying and mitigating such threats.

Users should stay vigilant and regularly update their security measures to protect against these sophisticated attacks.

Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers


Latest articles

WikiLeaks Founder Julian Assange Released in Stunning Deal with U.S.

WikiLeaks founder Julian Assange has been released from prison after reaching a deal with...

Four Members of FIN9 Hackers Charged for Attacking U.S. Companies

Four Vietnamese nationals have been charged for their involvement in a series of computer...

BREAKING: NHS England’s Synnovis Hit by Massive Cyber Attack

In a shocking development, the NHS has revealed that it was the victim of...

Threat Actor Claiming a 0-day in Linux LPE Via GRUB bootloader

A new threat actor has emerged, claiming a zero-day vulnerability in the Linux GRUB...

LockBit Ransomware Group Claims Hack of US Federal Reserve

The notorious LockBit ransomware group has claimed responsibility for hacking the U.S. Federal Reserve,...

Microsoft Power BI Vulnerability Let Attackers Access Organizations Sensitive Data

A vulnerability in Microsoft Power BI allows unauthorized users to access sensitive data underlying...

Consulting Companies to Pay $11 Million Failing Cybersecurity Requirements

Two consulting companies, Guidehouse Inc. and Nan McKay and Associates, have agreed to pay...
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles