PyPi Is Under Attack: Project Creation and User Registration Suspended

A few hours ago, The Python Package Index (PyPi) suspended new project creation and new user registration to mitigate an ongoing malware upload campaign.

The research team of Checkmarx simultaneously investigated a campaign of multiple malicious packages appear to be related to the same threat actors.

The threat actors target victims with Typosquatting attack technique using their CLI to install Python packages. 

This is a multi-stage attack and the malicious payload aimed to steal crypto wallets, sensitive data from browsers …

attack campaign checkmarx index malicious malicious packages malware package packages project pypi python python package python package index registration research target team threat threat actors under upload