{"id":10181,"date":"2025-03-15T06:26:27","date_gmt":"2025-03-15T06:26:27","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/malicious-pypi-packages-steal-cloud-tokens\/"},"modified":"2025-03-15T06:26:29","modified_gmt":"2025-03-15T06:26:29","slug":"malicious-pypi-packages-steal-cloud-tokens","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/malicious-pypi-packages-steal-cloud-tokens\/","title":{"rendered":"Malicious PyPI Packages Steal Cloud Tokens"},"content":{"rendered":"\n<\/p>\n<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Mar 15, 2025<\/span><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><\/span><span class=\"p-tags\"> Malware \/ Supply Chain Security<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\">\n<a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjCKm0W6Smhs8d_aZlimvRWcIqLvORW1VZ14ceCMMgi4kB2tYz_2dxEmBi0by3FAB7IsKgDcM69Of_yBcT-XP0_gbCEYC9QEXTwPTgVrTV-H07kxGA5f5ekvjLUA390B6O111GoIZhPXtXcfT3otnfkataMHrCktMHgrtNj3pXGzbqIn3WhWCXHNIdhDIAl\/s728-rw-e365\/supply-chain.png\" style=\"clear: left; display: block; float: left;  text-align: center;\" rel=\"nofollow noopener\" target=\"_blank\"><\/p>\n<p><\/a>\n<\/div>\n<p>Cybersecurity experts have identified a malicious campaign targeting Python Package Index (PyPI) users with fake libraries disguised as &#8220;time&#8221; related utilities. These libraries, however, contain hidden functionality designed to steal sensitive data, including cloud access tokens.<\/p>\n<p>ReversingLabs, a software supply chain security firm, <a href=\"https:\/\/x.com\/ReversingLabs\/status\/1900198602242204003\" rel=\"noopener nofollow\" target=\"_blank\">discovered<\/a> two sets of packages, totaling 20, which have been downloaded over 14,100 times. The packages include:<\/p>\n<ul>\n<li>snapshot-photo (2,448 downloads)<\/li>\n<li>time-check-server (316 downloads)<\/li>\n<li>time-check-server-get (178 downloads)<\/li>\n<li>time-server-analysis (144 downloads)<\/li>\n<li>time-server-analyzer (74 downloads)<\/li>\n<li>time-server-test (155 downloads)<\/li>\n<li>time-service-checker (151 downloads)<\/li>\n<li>aclient-sdk (120 downloads)<\/li>\n<li>acloud-client (5,496 downloads)<\/li>\n<li>acloud-clients (198 downloads)<\/li>\n<li>acloud-client-uses (294 downloads)<\/li>\n<li>alicloud-client (622 downloads)<\/li>\n<li>alicloud-client-sdk (206 downloads)<\/li>\n<li>amzclients-sdk (100 downloads)<\/li>\n<li>awscloud-clients-core (206 downloads)<\/li>\n<li>credential-python-sdk (1,155 downloads)<\/li>\n<li>enumer-iam (1,254 downloads)<\/li>\n<li>tclients-sdk (173 downloads)<\/li>\n<li>tcloud-python-sdks (98 downloads)<\/li>\n<li>tcloud-python-test (793 downloads)<\/li>\n<\/ul>\n<p>The first set of packages is used to upload data to the threat actor&#8217;s infrastructure, while the second set implements cloud client functionalities for services like Alibaba Cloud, Amazon Web Services, and Tencent Cloud. However, these packages also exfiltrate cloud secrets using &#8220;time&#8221; related packages.<\/p>\n<div class=\"dog_two clear\">\n<center class=\"cf\"><br \/>\n<a href=\"https:\/\/thehackernews.uk\/cis-securesuite\" rel=\"nofollow noopener sponsored\" target=\"_blank\" title=\"Cybersecurity\"><br \/>\n<img fetchpriority=\"high\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhsFQaSLfkFdKcodtNnSya8V2yj1C_ZVcqQImhnHDikdLhrgZ4hoAIdzNPEjMn6tIl2dSBa9PZVJm5Q6CW4Iprd32O0xaNt3UTVX1U9kEK629GDLqpr7Dd6lynygeNXdkuKNi_TlVZ1vRZI_fXFdvFwBm25WNf4tQHZfgpXHiaw1nnd6E5jLX8vrn4fB3mN\/s728-e100\/cis-d.png\" width=\"727\" height=\"90\"\/><br \/>\n<\/a><br \/>\n<\/center>\n<\/div>\n<p>All the identified packages have been removed from PyPI. Further analysis revealed that three packages &#8211; <a href=\"https:\/\/github.com\/kohlersbtuh15\/accesskey_tools\/blob\/main\/aliyun\/requirements.txt\" rel=\"noopener nofollow\" target=\"_blank\">acloud-client<\/a>, <a href=\"https:\/\/github.com\/kohlersbtuh15\/accesskey_tools\/blob\/main\/aws\/requirements.txt\" rel=\"noopener nofollow\" target=\"_blank\">enumer-iam<\/a>, and <a href=\"https:\/\/github.com\/kohlersbtuh15\/accesskey_tools\/blob\/main\/tencentcloud\/requirements.txt\" rel=\"noopener nofollow\" target=\"_blank\">tcloud-python-test<\/a> &#8211; have been listed as dependencies of a GitHub project named <a href=\"https:\/\/github.com\/kohlersbtuh15\/accesskey_tools\" rel=\"noopener nofollow\" target=\"_blank\">accesskey_tools<\/a>, which has been forked 42 times and starred 519 times.<\/p>\n<div class=\"separator\" style=\"clear: both;\">\n<a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhUhlesBOrlKCLtTKuN_nI2cbP3eIfIGA7WUTtZIA7hwZSit_ohLKyZpdxS3IIGUlK5qhgl5fDwOXfdr5Jq3GuOo2oP9Yv8GQ4YIReiH-gCBvz-ICfwHhR-kdRap11zjxTnHP_WGif9aUh_KyhAo_hxp2oPqSDonKJMGsteeW-m88LklSNqPg8Tue-sH59s\/s728-rw-e365\/access.png\" style=\"clear: left; display: block; float: left;  text-align: center;\" rel=\"nofollow noopener\" target=\"_blank\"><br \/>\n<img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhUhlesBOrlKCLtTKuN_nI2cbP3eIfIGA7WUTtZIA7hwZSit_ohLKyZpdxS3IIGUlK5qhgl5fDwOXfdr5Jq3GuOo2oP9Yv8GQ4YIReiH-gCBvz-ICfwHhR-kdRap11zjxTnHP_WGif9aUh_KyhAo_hxp2oPqSDonKJMGsteeW-m88LklSNqPg8Tue-sH59s\/s728-rw-e365\/access.png\" alt=\"Malicious PyPI Packages\" border=\"0\" data-original-height=\"788\" data-original-width=\"1339\" title=\"Malicious PyPI Packages\"\/><br \/>\n<\/a>\n<\/div>\n<p>A source code commit referencing tcloud-python-test was made on November 8, 2023, indicating that the package has been available for download on PyPI since then. The package has been downloaded 793 times, according to pepy.tech statistics.<\/p>\n<p>Fortinet FortiGuard Labs <a href=\"https:\/\/www.fortinet.com\/blog\/threat-research\/fortinet-identifies-malicious-packages-in-the-wild-insights-and-trends\" rel=\"noopener nofollow\" target=\"_blank\">reported<\/a> discovering thousands of packages across PyPI and npm, some of which contain suspicious install scripts designed to deploy malicious code during installation or communicate with external servers.<\/p>\n<p>&#8220;Suspicious URLs are a key indicator of potentially malicious packages, as they are often used to download additional payloads or establish communication with command-and-control (C&amp;C) servers, giving attackers control over infected systems,&#8221; said Jenna Wang.<\/p>\n<p>&#8220;In 974 packages, such URLs are linked to the risk of data exfiltration, further malware downloads, and other malicious actions. It is crucial to scrutinize and monitor external URLs in package dependencies to prevent exploitation.&#8221;<\/p>\n<p><\/p>\n<div class=\"cf note-b\">Found this article interesting?  Follow us on <a href=\"https:\/\/twitter.com\/thehackersnews\" rel=\"noopener nofollow\" target=\"_blank\">Twitter <i class=\"icon-font icon-twitter\">\uf099<\/i><\/a> and <a href=\"https:\/\/www.linkedin.com\/company\/thehackernews\/\" rel=\"noopener nofollow\" target=\"_blank\">LinkedIn<\/a> to read more exclusive content we post.<\/div>\n<\/div>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/>\n<br \/><a href=\"https:\/\/thehackernews.com\/2025\/03\/malicious-pypi-packages-stole-cloud.html\" rel=\"nofollow noopener\" target=\"_blank\">Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ue802Mar 15, 2025\ue804Ravie Lakshmanan Malware \/ Supply Chain Security Cybersecurity experts have identified a malicious campaign targeting Python Package Index (PyPI) users with fake libraries disguised as &#8220;time&#8221; related utilities&#8230;.<\/p>\n","protected":false},"author":19,"featured_media":10182,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-10181","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/03\/supply-chain.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/10181","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=10181"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/10181\/revisions"}],"predecessor-version":[{"id":10183,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/10181\/revisions\/10183"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/10182"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=10181"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=10181"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=10181"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}