AWS keys stolen by malicious PyPI package with thousands of downloads

News
By
published

A typosquatted package was sitting in PyPI for years

The Python banner logo on a computer screen running a code editor.
(Image credit: Shutterstock / Trismegist san)
  • Researchers discover three-year old malicious package in PyPI
  • The package is a typosquatted version of Fabric, with 37,000 downloads
  • Its goal is to steal AWS login credentials from the developers

A malicious Python package has been hiding in the Python Package Index (PyPI) for years, stealthily stealing people’s Amazon Web Service (AWS) credentials.

Cybersecurity researchers Socket outlined how a package called “fabrice” was uploaded to the repository back in 2021 - before PyPl deployed its advanced scanning tool.

Since the tools did not scan retroactively, the package remained on the platform and was offered to the users.

Hidden Risk

PyPI is one of the most popular Python package repositories in the world, with millions of daily downloads and a half-million hosted packages.

Fabrice is a typosquatted version of the “fabric” library, a package for SSH-based remote server management, designed to simplify system administration and deployment tasks. It is primarily used for scripting and automating tasks across multiple servers, and enables users to run shell commands remotely over SSH.

According to BleepingComputer, it has more than 200 million downloads, making it extremely popular, however its typosquatted version did not fare too badly itself, being downloaded more than 37,000 times by the time it was identified as malicious.

Fabrice targets both Windows and Linux users, and while it comes with a number of features and persistence mechanisms, its key job is to steal Amazon Web Services accounts. Once identified, the malware exfiltrates them to a VPN server, apparently operated by the the connectivity and cloud services provider, M247, in Paris, France. That makes tracking the actual destination more difficult, it was said.

To defend against these attacks, businesses can do two things - make sure they know exactly what they’re downloading from the internet, and deploy AWS Identity and Access Management (IAM) to manage permissions to the resources.

Typosquatting on PyPI is a common occurrence these days, and is the root cause of some of the bigger software supply chain attacks today.

“We recommend customers who use the legitimate software “fabric” for SSH interactions ensure they are not inadvertently using the malware “fabrice.” AWS customers who suspect malicious activity within their AWS accounts or credentials should follow guidance for remediating potentially compromised AWS credentials or contact AWS Support for assistance. Maintaining proper software supply chain security, including validating the correct source code and name of any software or dependency installed, reduces the risk posed by packages that abuse credentials. AWS contributes to the software supply chain security of Python’s open source ecosystem through an industry first Python Package Index (PyPi) Security Sponsorship with Python Software Foundation," an AWS spokesperson told TechRadar Pro in a statement.

You might also like

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.