MAL-2023-8363

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/python-alibabacloud-tea-openapi/MAL-2023-8363.json

JSON Data

https://api.test.osv.dev/v1/vulns/MAL-2023-8363

Published

2023-10-13T03:23:13Z

Modified

2023-10-13T03:23:13Z

Summary

Malicious code in python-alibabacloud-tea-openapi (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: google-open-source-security (1a75cd94261db49f7ab1e359b2579e7645756a48f20eb6a49465f980f5c2b43d)

Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI.

The malicious code was hidden in strategicly chosen functions and would only trigger when these functions were called. The malicious code does not automatically run on install or import, helping the packages evade detection.

Database specific

{
    "iocs": {
        "urls": [
            "https://api.aliyun-sdk-requests.xyz/tencent",
            "https://api.aliyun-sdk-requests.xyz/aliyun",
            "https://api.aliyun-sdk-requests.xyz/aws",
            "https://tg.aliyun-sdk-requests.xyz/telegram"
        ]
    },
    "malicious-packages-origins": [
        {
            "modified_time": "2023-10-13T03:23:13Z",
            "import_time": "2023-10-13T03:24:19.522372252Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "ECOSYSTEM"
                }
            ],
            "source": "google-open-source-security",
            "sha256": "1a75cd94261db49f7ab1e359b2579e7645756a48f20eb6a49465f980f5c2b43d"
        }
    ]
}

References

https://blog.phylum.io/cloud-provider-credentials-targeted-in-new-pypi-malware-campaign/

Credits

- Phylum - FINDER
- - support@phylum.io

Affected packages

PyPI / python-alibabacloud-tea-openapi

Package

Name: python-alibabacloud-tea-openapi; View open source insights on deps.dev
Purl: pkg:pypi/python-alibabacloud-tea-openapi

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected