Malicious PyPI and npm Packages Discovered Exploiting Dependencies in Supply Chain Attacks
A malicious package that adds malicious behavior through a dependency that enables it to establish persistence and accomplish code execution has been found by cybersecurity experts in the Python Package Index (PyPI) repository.
According to Zscaler ThreatLabz, the program, dubbed termncolor, uses a multi-stage malware operation to actualize its malicious capability through a dependent package called colorinal. Colorinal received 529 downloads, compared to 355 for termncolor. On PyPI, both libraries are no longer accessible.
According to researchers Manisha Ramcharan Prajapati and Satyam Singh, this attack may use DLL side-loading to enable decryption, create persistence, and carry out command-and-control (C2) communication, ultimately leading to remote code execution.
Following i...