Two malicious libraries that were caught stealing SSH and GPG keys from developer projects were removed from the PyPI repository. One of the libraries went unnoticed for almost a year.
Both libraries had the same author (olgired2017), who used the typosquatting technique, that is, he called his “products” as closely as possible to other popular libraries, changing only a couple of characters. So, the first library was python3-dateutil (uploaded November 29, 2019) simulating a popular dateutil, and second – jeIlyfish (the first “L”, this is actually an “I”; loaded on December 11, 2018), disguised as jellyfish.
Malicious clones December 1, 2019 discovered German developer Lukas Martini (Lukas Martini), about which he hastened to notify the Python security team. Both libraries were removed from PyPI on the same day. Martini writes that the malicious code was present only in the jeIlyfish library, and python3-dateutil simply imported the malicious jeIlyfish.
Since neither Martini nor PyPI representatives explained what exactly the malicious libraries were doing, journalists of the publication Zdnet asked for a comment from dateutil developer Paul Ganssle. He said that the malicious code in jeIlyfish downloaded from GitLab a file called hashsum, which at first glance looked like complete nonsense, but then it was decoded into a Python file and executed.
“It seems that (this file) was trying to steal SSH and GPG keys from the user's computer and send them to this IP address: http: //68.183.212 (.) 246: 32258,” the expert says.
In addition, the attacker was clearly trying to determine for which projects credentials could work (a list of a number of directories was compiled, including home and PyCharm Projects) in order to compromise the products of the victim developer.
Let me remind you that before this case, malicious libraries in PyPI were detected three times already in recent years (1, 2, 3).