TeamPCP has initiated another campaign similar to the Mini Shai-Hulud attack, targeted at supply chain development in npm and PyPI environments, including TanStack, uipath and mistralai (although these two were ultimately rendered non-functional due to a pre-exisitng bug in the packages). Using the same command-and-control infrastructure as previous campaigns, this latest attack affects several layers of development ecosystems, with persistence and propagation being key facets of the attack, as well as credential stealing and data wiping.

One of the stages of this malware is installation of a persistent gh-token-monitor daemon. But what is that exactly? In computing, a daemon is a background process, running without the need for user interaction or permission. It’s used mostly for Unix based systems, which are often the backbone of package development. Because it requires no oversight, poisoning its architecture can go unnoticed until persistence is established and/or the poisoned dataset is integrated into the main registry. In this case, the token monitor is looking for a set of criteria that, if met, determines whether or not a wiper is applied. The malware identifies any GitHub Personal Access Tokens or Oauth Tokens, then runs them through a series of checks looking for validity that contains a login field, a repo or public_repo in its scope, public profile, ability to write a repository, and whether the tokens belong to a member of an org.

A Python variant is also being distributed, malicious versions of guardrails-ai[@]0.10.1 and mistralai[@]2.4.6. These are trojanized and operate differently than the JavaScript version of the malware. They are not obfuscated and contain a modular credential stealer that executes on Linux machines that are not in Russian (which the JavaScript version does as well). The data this variant exfiltrates includes password vaults like Bitwarden. This version also contains a command to execute a full volume mp3 file while running file deletion if the location settings – timezone and language – are Israeli or Iranian.

This campaign has another notable upgrade from previous attacks besides the wiper daemon, namely redundancies in terms of C2 architecture. Instead of funneling the data to just one place, it is now being sent to three. A typosquatted domain, a session messenger network and GitHub API dead drop repositories with a Dune theme.

The team at nmp is removing the malicious packages from the registry as soon as they find them, but Wiz has other recommendations for avoiding infection. Aside from the common sense tactic of rotating credentials, which should be happening frequently in the first place as the first step to prevention of credential stealing, they encourage developers to keep an eye on exposure, searching lockfiles and CI logs for affected package versions. Watch out for persistence. Search for the gh-token-monitor daemon on developer machines and remove it. Do this before revoking GitHub tokens, to avoid the wiper. Audit IDE directories, since router_runtime.js and setup.mjs persist after npm uninstall. And finally, block the C2 infrastructure at the DNS/proxy level, as the domains are known (git-tanstack[.]com and *.getsession[.]org). Wiz’s article also contains further links to postmortems of each of the affected packages for more information.

Malicious dYdX libraries on npm and PyPI stole wallet credentials and installed remote-access malware, threatening cryptocurrency traders and automated trading tools.

Source: Socket

I’ve been working on making the star chart code more accessible and now it is! Download the first stable release on Python:

pip install star-chart-spherical-projection

This is a new Python package to generate an astronomy star chart. The center of the map is +90/-90° and all around it are stars

The stars have been transformed from the celestial sphere onto a 2D circular map based on a star's position (declination and right ascension) and can generate maps for the past, present, and future with proper motion and precession

Currently, the map works with proper motion and for precession (for long periods of time)

A direct one-to-one map will create a great deal of distortion since without an additional step, the angles between the stars are not preserved

On the left, the constellation of the Big Dipper is stretched into an unfamiliar shape. By accounting for the spherical transformation, the star chart can be corrected as seen on the right

The sphere is projected from the South Pole (via Sterographic projection):

Example for Star Chart in the Northern Hemisphere (centered on 90°)

Example for Star Chart in the Southern Hemisphere (centered on -90°)

For clarity I left off the star labels, but they can added back easily. I made it as simple to use as I could, only needs information about whether to project from the north or south pole

————————————————————————

import star_chart_spherical_projection

star_chart_spherical_projection. plotStereographicProjection(northOrSouth="North")

Publish a (Perfect) Python Package on PyPI | Tutorial for Beginners ☞ https://morioh.com/p/e5b47c06f7ad?f=5c21fb01c16e2556b555ab32

A trojan PyPI package masquerading as SymPy quietly deployed XMRig miners in memory, targeting Linux developers and CI pipelines.

Source: Socket

A malicious package called SoopSocks, posing as a proxy server tool, was found on PyPI hiding stealthy backdoor features, auto-installers, and data exfiltration to Discord.

Source: JFrog Security Research

Attackers are sending convincing “account verification” emails to PyPI developers, tricking them into entering passwords on a fake site at pypi-mirror.org, part of an ongoing phishing campaign expected to keep shifting domains.

Source: Python Package Index

They say nothing on the internet is ever truly gone, and Truffle Security has recently proven the adage to be true. They have recovered and scanned 600,000 PyPI package releases with TruffleHog, discovering 190 unique secrets, including a GitHub Personal Access Token (PAT) with admin access to the Apache and Astronomer organizations. The discovery began with finding a GitHub PAT in a package from April 2023. It grants admin access to the Apache and Astronomer GitHub organizations, and was still active, along with some – thankfully – now invalid AWS tokens. They disclosed both findings to the appropriate hosts, who revoked them within hours.

So how does this happen, and why? Truffle tested the process to understand exactly what’s happening when a package is deleted. What they found has been dubbed ‘ghost persistence’. When a user deletes a package, the registry’s database removes the pointer to the website and API, and a 404 error code will pop up when anyone tries to download it from PyPI.. The file itself, however, stays where it was: on the Python Package Index official object storage server. Which means that the secrets it holds do too. PyPI’s policy on hard deletion is reserved only for when Personally Identifiable Information (PII) is leaked. If one has the full URL and tarball of a package, it can still be found.

That said, gaining that information runs along the lines of ‘you have to know it’s there’; it’s not something one might stumble across organically. Generally speaking, if one tried to download a deleted package and saw the error code, they’d assume that package is gone. Still, it is a vulnerability in developer ecosystems. Truffle says devs should not consider deletion a security control, and that once a secret touches a public ecosystem, it should be considered compromised.

The URL is only part of the equation, though. Object storage is a hash-based directory structure. Leveraging PyPI’s metadata to reconstruct the path is possible. PyPI maintains a public BigQuery dataset containing metadata for every package ever uploaded, one assumes for uniqueness in naming and filing. Querying that dataset can be used to discover the full URL of every package contained in it. Filtering through a python script for availability narrows the field to the ones that have been ‘deleted’, which still evidently contain their active tokens, keys and/or secrets.

And what kinds of secrets are we talking about? Truffle breaks down the variety they found into several categories, nearly half of which were present in every version and some contained multiples. These included Discord Webhooks, Telegram bot tokens, Infura, AWS and Slack Webhooks. All of which would be valuable resources for malicious infiltration, exploitation and selling on the dark web. And these are just the most common secrets found, it’s not an exhaustive list.

This is not a new issue. The oldest one was from 2018, containing a still live Telegram token, while the newest was from January of this year, containing a still valid Postgres credentials. Truffle’s article has some tips for checking if secrets are being leaked, and how to remediate the issue. Being aware that this issue exists, however, is probably the biggest key to preventing it from being abused. Rotating credentials on a regular basis would make these secrets more inaccessible, or at least invalid in terms of exploiting them. Short of that, revocation of these tokens as soon as they hit a public ecosystem is the most reliable way to keep secrets secret.