Summary:
The Socket Research Team has uncovered a malicious Python package named ‘crytic-compilers’ that is a result of a typosquatting attack. This package masquerades as a legitimate tool for smart contract compilation but contains a trojan executable that targets Windows systems. The incident highlights the risks associated with open-source package registries and the need for vigilant monitoring.
#Typosquatting #PythonSecurity #MaliciousPackages
The Socket Research Team has uncovered a malicious Python package named ‘crytic-compilers’ that is a result of a typosquatting attack. This package masquerades as a legitimate tool for smart contract compilation but contains a trojan executable that targets Windows systems. The incident highlights the risks associated with open-source package registries and the need for vigilant monitoring.
#Typosquatting #PythonSecurity #MaliciousPackages
Keypoints:
Malicious behavior identified in the Python package ‘crytic-compilers’ on PyPI.
The package is a typosquatting variant of the legitimate ‘crytic-compile’ used for smart contract compilation.
It has been downloaded approximately 6,000 times daily, indicating its popularity in the crypto development community.
The malicious package executes a trojan named ‘s.exe’ on Windows systems.
465 repositories depend on ‘crytic-compile’, showcasing its significance.
The malicious script conditionally executes the trojan based on the operating system.
The trojan ‘s.exe’ has been flagged by multiple antivirus engines on VirusTotal.
Continuous monitoring of packages is essential to protect the software supply chain.
MITRE Techniques:
Execution (T1203): The malicious package executes a trojan on Windows systems.
Command and Control (T1071): The package attempts to download ‘crytic-compile’ from its GitHub repository while executing malicious payloads.
Defense Evasion (T1203): The script checks the operating system to conditionally execute the trojan, evading detection on non-Windows platforms.
IoC:
[File Name] s.exe
[File Hash] b09ef792135fd0896ce7eb57638ea9199f1ae37f4a374398198a54bd84e2a5a2
Full Research: https://socket.dev/blog/trojan-embedded-in-crytic-compilers-python-package