{"id":32135,"date":"2019-12-04T00:52:00","date_gmt":"2019-12-04T00:52:00","guid":{"rendered":"http:\/\/e20cafd8-fbca-4baa-add5-cf9d42e2af72"},"modified":"2019-12-04T00:52:00","modified_gmt":"2019-12-04T00:52:00","slug":"two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\/","title":{"rendered":"Two malicious Python libraries caught stealing SSH and GPG keys"},"content":{"rendered":"<p><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/zdnet4.cbsistatic.com\/hub\/i\/2019\/12\/04\/9d6de096-5c14-4888-976b-6bb4a36a5c61\/3b8da917af66d7d01f9849156e6d6e04\/olgired2017.png\" class alt=\"olgired2017.png\"><\/span><span class=\"credit\">Image: ZDNet<\/span> <\/p>\n<div class=\"relatedContent alignRight\">\n<h3 class=\"heading\"><span class=\"int\">techrepublic cheat sheet<\/span><\/h3>\n<\/div>\n<p>The Python security team removed two trojanized Python libraries from PyPI (Python Package Index) that were caught stealing SSH and GPG keys from the projects of infected developers.<\/p>\n<p>The two libraries were created by the same developer and mimicked other more popular libraries &#8212; using a technique called <a href=\"https:\/\/en.wikipedia.org\/wiki\/Typosquatting\" target=\"_blank\" rel=\"noopener noreferrer\" data-component=\"externalLink\">typosquatting<\/a> to register similarly-looking names.<\/p>\n<p>The first is &#8220;<a href=\"https:\/\/pypi.org\/project\/python3-dateutil\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">python3-dateutil<\/a>,&#8221; which imitated the popular &#8220;<a href=\"https:\/\/pypi.org\/project\/python-dateutil\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">dateutil<\/a>&#8221; library. The second is &#8220;<a href=\"https:\/\/pypi.org\/project\/jeIlyfish\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">jeIlyfish<\/a>&#8221; (the first L is an I), which mimicked the &#8220;<a href=\"https:\/\/pypi.org\/project\/jellyfish\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">jellyfish<\/a>&#8221; library.<\/p>\n<p>The two malicious clones were <a href=\"https:\/\/github.com\/dateutil\/dateutil\/issues\/984\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">discovered<\/a> on Sunday, December 1, by German software developer Lukas Martini. Both libraries were removed on the same day after Martini notified dateutil developers and the PyPI security team.<\/p>\n<p>While the python3-dateutil was created and uploaded on PyPI two days before, on November 29, the jeIlyfish library had been available for nearly a year, since December 11, 2018.<\/p>\n<h3>Stealing SSH and GPG keys<br \/><\/h3>\n<p>According to Martini, the malicious code was present only in the jeIlyfish library. The python3-dateutil package didn&#8217;t contain malicious code of its own, but it did import the jeIlyfish library, meaning it was malicious by association.<\/p>\n<p>The code downloaded and read <a href=\"https:\/\/gitlab.com\/olgired2017\/aeg_wandoo_dag_m3\/raw\/master\/hashsum\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">a list of hashes<\/a> stored in a GitLab repository. The nature and purpose of these hashes was initially unknown, as neither Martini or the PyPI team detailed the behavior in great depth before the library was promptly removed from PyPI.<\/p>\n<section class=\"sharethrough-top\" data-component=\"medusaContentRecommendation\" data-medusa-content-recommendation-options=\"{&quot;promo&quot;:&quot;promo_zd_recommendation_sharethrough_top_in_article_desktop&quot;,&quot;spot&quot;:&quot;dfp-in-article&quot;}\">\n<\/section>\n<p><em>ZDNet<\/em> asked today Paul Ganssle, a member of the dateutil library to take a closer look at the malicious code and put it in perspective for our readers.<\/p>\n<p>&#8220;The code directly in the `jeIlyfish` library downloads a file called &#8216;hashsum&#8217; that looks like nonsense from a gitlab repo, then decodes that into a Python file and executes it,&#8221; Ganssle told <em>ZDNet<\/em>.<\/p>\n<p>&#8220;It looks like [this file] tries to exfiltrate SSH and GPG keys from a user&#8217;s computer and send them to this IP address: <strong>http:\/\/68.183.212.246:32258<\/strong>.&#8221;<\/p>\n<p>&#8220;It also lists a bunch of directories, home directory, PyCharm Projects directory,&#8221; Ganssle added. &#8220;If I had to guess what the purpose of that is, I would say it&#8217;s to figure out what projects the credentials work for so that the attacker can compromise that person&#8217;s projects.&#8221;<\/p>\n<h3>Developers advised to review projects<\/h3>\n<p>Both of the malicious libraries were uploaded on PyPI by the same developer, who used the username of olgired2017 &#8212; also used for the GitLab account.<\/p>\n<p>It is believed that olgired2017 created the dateutil clone in an attempt to capitalize on the original&#8217;s library popularity and increase the reach of the malicious code; however, this also brought more attention from more developers and eventually ended up in exposing his entire operation.<\/p>\n<p>Excluding the malicious code, both typosquatted packages were identical copies of the original libraries, meaning they would have worked as the originals.<\/p>\n<p>Developers who didn&#8217;t pay attention to the libraries they downloaded or imported into their projects should check to see if they&#8217;ve used the correct package names and did not accidentally use the typosquatted versions.<\/p>\n<p>If they accidentally used any of the two, developers are advised to change the all SSH and GPG keys they&#8217;ve used over the past year.<\/p>\n<p>This is the third time the PyPI team intervenes to remove typo-squatted malicious Python libraries from the official repository. Similar incidents have happened in <a href=\"http:\/\/www.nbu.gov.sk\/skcsirt-sa-20170909-pypi\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">September 2017<\/a> (ten libraries), <a href=\"https:\/\/www.zdnet.com\/article\/twelve-malicious-python-libraries-found-and-removed-from-pypi\/\" target=\"_blank\" rel=\"noopener noreferrer\">October 2018<\/a> (12 libraries), and <a href=\"https:\/\/www.zdnet.com\/article\/malicious-python-libraries-targeting-linux-servers-removed-from-pypi\/\" target=\"_blank\" rel=\"noopener noreferrer\">July 2019<\/a> (three libraries).<\/p>\n<p><em>Article updated one hour after publication with Genssle&#8217;s analysis.<\/em><\/p>\n<p> READ MORE <a href=\"https:\/\/www.zdnet.com\/article\/two-malicious-python-libraries-removed-from-pypi\/#ftag=RSSbaffb68\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>One library was available for only two days, but the second was live for nearly a year.<br \/>\nREAD MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":32136,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-32135","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zdnet-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Two malicious Python libraries caught stealing SSH and GPG keys 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Two malicious Python libraries caught stealing SSH and GPG keys 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2019-12-04T00:52:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/12\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1013\" \/>\n\t<meta property=\"og:image:height\" content=\"464\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Two malicious Python libraries caught stealing SSH and GPG keys\",\"datePublished\":\"2019-12-04T00:52:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\\\/\"},\"wordCount\":584,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/12\\\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys.png\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\\\/\",\"name\":\"Two malicious Python libraries caught stealing SSH and GPG keys 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/12\\\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys.png\",\"datePublished\":\"2019-12-04T00:52:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/12\\\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys.png\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/12\\\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys.png\",\"width\":1013,\"height\":464},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Two malicious Python libraries caught stealing SSH and GPG keys\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Two malicious Python libraries caught stealing SSH and GPG keys 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\/","og_locale":"en_US","og_type":"article","og_title":"Two malicious Python libraries caught stealing SSH and GPG keys 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2019-12-04T00:52:00+00:00","og_image":[{"width":1013,"height":464,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/12\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys.png","type":"image\/png"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Two malicious Python libraries caught stealing SSH and GPG keys","datePublished":"2019-12-04T00:52:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\/"},"wordCount":584,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/12\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys.png","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\/","url":"https:\/\/www.threatshub.org\/blog\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\/","name":"Two malicious Python libraries caught stealing SSH and GPG keys 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/12\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys.png","datePublished":"2019-12-04T00:52:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/12\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys.png","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/12\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys.png","width":1013,"height":464},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Two malicious Python libraries caught stealing SSH and GPG keys"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/32135","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=32135"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/32135\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/32136"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=32135"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=32135"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=32135"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}