{"id":50846,"date":"2023-03-03T18:30:40","date_gmt":"2023-03-03T18:30:40","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/frankenstein-malware-stitched-together-from-code-of-others-disguised-as-pypi-package\/"},"modified":"2023-03-03T18:30:40","modified_gmt":"2023-03-03T18:30:40","slug":"frankenstein-malware-stitched-together-from-code-of-others-disguised-as-pypi-package","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/frankenstein-malware-stitched-together-from-code-of-others-disguised-as-pypi-package\/","title":{"rendered":"Frankenstein malware stitched together from code of others disguised as PyPI package"},"content":{"rendered":"

A malicious package discovered in the Python Package Index (PyPI) is the latest example of what threat hunters from Kroll called the continued “democratization of cybercrime,” with the bad guys creating malware variants from the code of others.<\/p>\n

It reflects the as-a-service trend in ransomware<\/a>, distributed denial-of-service (DDoS<\/a>), and other malware, which lets crooks with little or no skills lease or buy weapons to launch their own attacks. In this case, it means pulling together code from multiple sources to build the malware in packages uploaded into PyPI.<\/p>\n

Dropping malicious packages into PyPI<\/a>, GitHub, NPM, RubyGems<\/a>, and other repositories, and enticing developers to inadvertently put them into their products is a fast-growing part of threats<\/a> against the software supply chain.<\/p>\n