Malware Upload Attack Hits PyPI Repository
28-May-24
The confirmation of the PyPI incident, which has since been resolved, comes as security researchers at Checkmarx warn that multiple malicious Python packages are being pushed via typo-squatting techniques.
The malicious code is located within each package’s setup.py file, enabling automatic execution upon installation,” Checkmarx explained. “Upon execution, the malicious code within the setup.py file attempted to retrieve an additional payload from a remote server. The URL for the payload was dynamically constructed by appending the package name as a query parameter
