Malicious 'botaa3' Package Discovered on PyPI, Targeting 'boto3' Users
A malicious package named 'botaa3' was discovered on the Python Package Index (PyPI) repository on November 18, 2021. Sonatype's automated systems spotted the threat, which was swiftly removed by PyPI's security team. The package, published by 'Shh Not Cool Bro' the previous day, was a typosquatting attempt to mimic 'boto3', a popular AWS SDK for Python.
Sonatype's automated malware detection systems flagged the 'botaa3' package due to its suspicious contents. Upon investigation, it was found to contain a base64-encoded payload, further scrambled using bitwise XOR encryption. Decrypting the payload revealed around 1060 lines of code that established a secure connection to an attacker's command-and-control (C2) server at 'install.pypi-installer[.]com'.
The malicious package was designed to perform various tasks on infected machines, including directory traversal, file upload/download, environment variable retrieval, and spawning reverse shells. It was also capable of exfiltrating system details to the C2 server and executing commands received from the attacker. The package was cataloged as sonatype-2021-3445 and reported to PyPI by Sonatype's security research team. Despite being available for only a few hours, it was estimated to have been downloaded around 130 times.
The 'botaa3' package was taken down by the PyPI security team within hours of Sonatype's report. Sonatype Repository Firewall, powered by Sonatype Intelligence, helped protect software builds from this threat. Although the specific reason for the package's release remains unknown, users are advised to be cautious when installing packages from PyPI and to verify the authenticity of packages before use.
Read also:
- Germany Uncovers 32 Suspected Social Security Fraud Cases in Hotel and Catering Industry
- Manufacturing Under Siege: State-Sponsored Hackers Target Intellectual Property
- Chile's $10B Green Energy Project Threatens World-Class Observatory
- Exploring Harry Potter's Lineage: Decoding the Enigma of His Half-Blood Ancestry
