Phylum

Malicious Go Binary Delivered via Steganography in PyPI

Research

On May 10, 2024, Phylum’s automated risk detection platform alerted us to a suspicious publication on PyPI. The package was called requests-darwin-lite and appeared to be a fork of the ever-popular requests package with a

Phylum Research Team May 10, 2024 5 min read

Subscribe to our research

Keep up with the latest software supply chain attacks

Adding Spurious Wheels to PyPI

Learn how easy it is for threat actors to hide their malware in Python wheel artifacts hosted on the PyPI registry....

Charles Coggins May 10, 2024 4 min read

Modern Python Build Hooks

Arbitrary code execution is possible with build hooks offered by modern Python package installers when building modern PEP-518 pyproject.toml projects....

Charles Coggins May 6, 2024 14 min read

Devious Python Build Requirements

Build requirements in Python source distributions allow attackers to execute arbitrary code in an isolated build environment that is automatically deleted after use....

Charles Coggins Apr 29, 2024 11 min read

Python Package Installation Attacks

Arbitrary code execution is possible, and even common, during package installation. Find out how attackers use this to their advantage....

Charles Coggins Apr 24, 2024 5 min read