Dormant PyPI Package Updated to Deploy NovaSentinel Stealer

On Wednesday, February 21, Phylum’s automated risk detection platform alerted us to an anomalous publication of a PyPI package named django-log-tracker. This package was first published to PyPI in April 2022. The linked Github repository shows activity around the same time. It’s interesting to note, though,

april automated deploy detection django february github github repository log package phylum platform pypi pypi package repository research risk stealer tracker