The Python security team removed two trojanized Python libraries from PyPI (Python Package Index) that were stealing SSH and GPG keys from the projects of infected developers.
The Python security team removed two tainted Python libraries from PyPI (Python Package Index) that were found stealing SSH and GPG keys from the projects of infected developers.
Both libraries, “python3-dateutil” and “jeIlyfish,” were developed by the same developer (“olgired2017″) and have names similar to the ones of legitimate apps.
The name python3-dateutil imitated the popular “dateutil” library, while “jeIlyfish” (the first L is an I) imitated the “jellyfish” library.
The expert discovered the two libraries on December 1, by the German software developer Lukas Martini.
“Just a quick heads-up: There is a fake version of this package called python3-dateutil on PyPI that contains additional imports of the jeIlyfish package (itself a fake version of the jellyfish package, that first L is anI). That package in turn contains malicious code starting at line 313 in jeIlyfish/_jellyfish.py:” wrote Martini.
The “python3-dateutil” library was created and uploaded on PyPI on November 29, the “jeIlyfish” was uploaded on December 11, 2018, nearly one year ago.
The experts removed the two libraries the same day Martini reported his discovery to dateutil developers and the PyPI security team.
The jeIlyfish library contanins a malicious code, while the “python3-dateutil” library didn’t contain malicious code, but it was found importing the jeIlyfish library.
The tainted library attempts to exfiltrate SSH and GPG keys from the victim’s computer and send them to a server having IP address 188.8.131.52 at the port 32258.
Developers that used any of the two tainted libraries have to change all their SSH and GPG keys used since Decembre 2018.
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.
Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.