Cyber Security News

Two PyPi Malicious Package Mimic ChatGPT & Claude Steals Developers Data

Two malicious Python packages masquerading as tools for interacting with popular AI models ChatGPT and Claude were recently discovered on the Python Package Index (PyPI), the official repository for Python libraries.

These packages reportedly remained undetected for over a year, silently compromising developer environments and exfiltrating sensitive data.

As reported by a cybersecurity researcher, Leonid via X, the malicious packages were designed to exploit the growing popularity and adoption of AI tools in development workflows.

PyPi Malicious Package

Developers, eager to integrate ChatGPT and Claude into their projects, were unknowingly installing these malicious packages, believing them to be legitimate resources for engaging with OpenAI and Anthropic’s language models.

Maximizing Cybersecurity ROI: Expert Tips for SME & MSP Leaders – Attend Free Webinar

The packages, whose names have not yet been disclosed, operated by mimicking legitimate libraries, providing seemingly functional capabilities while embedding hidden malicious scripts.

These scripts exfiltrated sensitive information, including API keys, credentials, and possibly proprietary code, directly from developers’ systems to external servers controlled by the attackers.

The researcher emphasized that these packages managed to evade detection for over a year, highlighting significant challenges in securing open-source ecosystems.

The PyPI repository, a cornerstone for Python development, has faced increasing scrutiny in recent years due to the rise of malicious actors exploiting its openness.

This breach has sent shockwaves through the development community, as it underscores the potential risks of relying on unverified third-party libraries.

Developers are urged to immediately audit their dependencies and review any recent installations of AI-related packages.

PyPI maintainers are reportedly working to remove malicious packages and strengthen security protocols to prevent similar incidents in the future.

Experts recommend that developers adopt best practices, including verifying package authenticity, using virtual environments, and employing automated dependency scanners to detect vulnerabilities.

Are you from SOC/DFIR Teams? – Analyse Malware Files & Links with ANY.RUN -> Try for Free

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Lumma Stealer Upgraded with PowerShell Tools and Advanced Evasion Techniques

Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware has…

14 minutes ago

New Noodlophile Malware Spreads Through Fake AI Video Generation Platforms

Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as a…

22 minutes ago

Kimsuky Hacker Group Deploys New Phishing Techniques and Malware Campaigns

The North Korean state-sponsored Advanced Persistent Threat (APT) group Kimsuky, also known as “Black Banshee,”…

29 minutes ago

APT37 Hackers Use Weaponized LNK Files and Dropbox for Command-and-Control Operations

The North Korean state-sponsored hacking group APT37, also known as ScarCruft, launched a spear phishing…

40 minutes ago

Open Source Linux Firewall IPFire 2.29 – Core Update 194 Released: What’s New!

IPFire, the powerful open-source firewall, has unveiled its latest release, IPFire 2.29 – Core Update…

4 hours ago

Threat Actors Leverage DDoS Attacks as Smokescreens for Data Theft

Distributed Denial of Service (DDoS) attacks, once seen as crude tools for disruption wielded by…

5 hours ago