Listen to this Post
Cybercriminals have turned trusted developer tools into covert attack vectors. Seven malicious Python packages, silently embedded within the PyPI repository for years, were recently discovered exploiting Gmail’s SMTP servers and encrypted WebSocket tunnels to siphon sensitive data and execute remote commands. Even more alarming—some packages have amassed thousands of downloads, potentially compromising countless systems worldwide.
Covert Malware in Open Source Packages: A Breakdown
Researchers from Socket, a software supply chain security company, uncovered a disturbing pattern across several malicious Python packages that had infiltrated the popular Python Package Index (PyPI). These packages—posing as legitimate tools—hid advanced data exfiltration methods that used Gmail’s trusted infrastructure and secure WebSocket communications to bypass conventional defenses.
Key Takeaways:
- Seven PyPi packages uncovered: The names include Coffin-Codes-Pro, Coffin-Codes-NET2, Coffin-Codes-NET, Coffin-Codes-2022, Coffin2022, Coffin-Grave, and cfc-bsb.
- Masquerading strategy: The attackers impersonated a legitimate package named “Coffin,” typically used to integrate Jinja2 templates with Django.
- Massive reach: Some packages were hosted on PyPi for over four years, with Coffin-Codes-2022 alone downloaded more than 18,000 times.
- Data exfiltration method: Hardcoded Gmail credentials sent system reconnaissance data via
smtp.gmail.com. Gmail’s trusted status helped malware evade detection. - Remote command execution: Malware connected to external servers through encrypted WebSocket tunnels, enabling attackers to control compromised machines.
– Capabilities included:
– File transfers
– Shell access
– Admin panel infiltration
– Email and credential theft
– API hijacking
– Lateral movement within networks
- Crypto theft suspicion: Use of email addresses like
[email protected]hints at cryptocurrency targeting. - Response advice: Users who installed these packages should immediately remove them and rotate all associated credentials.
In a related discovery, researcher Ax Sharma from Sonatype reported a malicious npm package called crypto-encrypt-ts. This package claimed to be a TypeScript implementation of the now-defunct CryptoJS library, but instead targeted cryptocurrency wallet secrets. The malware exfiltrated data to a Better Stack endpoint and persisted using cron jobs, specifically targeting wallets holding balances over 1,000 units. Before being taken down, it had already been downloaded nearly 2,000 times.
This disturbing pattern underscores a larger issue: the software supply chain has become a prime target for cybercriminals, and developers may be unknowingly distributing malware by using compromised packages.
What Undercode Say:
The discovery of these malware-laden packages sheds light on a rapidly evolving threat in the open-source ecosystem. Threat actors are no longer merely interested in launching flashy ransomware attacks or phishing scams—they’re embedding sophisticated, persistent malware in the very tools developers trust to build modern applications.
Why this attack matters:
- Stealth over splash: By leveraging Gmail’s SMTP servers—an inherently trusted communication channel—the attackers ensured their activities blended seamlessly with legitimate traffic. Firewalls and Endpoint Detection and Response (EDR) systems often ignore Gmail traffic, making this an ingenious avenue for stealth communication.
-
WebSockets and SSL for persistence: The use of SSL-encrypted WebSockets adds another layer of complexity, allowing attackers to maintain long-term control of infected systems without triggering alarms.
-
Disguised as legitimate tooling: By copying the name and style of an existing open-source library (“Coffin”), the attackers lured developers into unknowingly integrating malicious code into their apps. This isn’t a simple case of malware disguised as something helpful—it’s an advanced social engineering tactic targeting developer trust.
-
Long-term infiltration: That some of these packages remained undetected on PyPI for more than four years is staggering. It reveals alarming gaps in the monitoring and vetting of packages uploaded to open repositories.
-
Financial motivation: The reference to email addresses related to blockchain and the previous use of similar methods in Solana theft incidents strongly suggests a clear financial incentive—crypto theft. Malware authors are tailoring their code to extract maximum value from compromised systems.
-
Global risk scale: With packages like Coffin-Codes-2022 downloaded over 18,000 times, the reach of this attack may be far greater than initially thought. Even a 1% compromise rate translates into hundreds of breached environments.
-
npm is not immune: The npm ecosystem, often thought to be more closely monitored, is equally vulnerable. The
crypto-encrypt-tspackage is a textbook example of malware hiding in plain sight—offering familiar functionality while stealing sensitive wallet data. -
The return of cron jobs: The npm package’s use of cron jobs to maintain persistence highlights a broader trend. Malware developers are revisiting traditional Unix-based methods to ensure survival across system reboots.
-
Supply chain attacks are the new normal: These incidents emphasize the growing dominance of supply chain attacks. By compromising one dependency, attackers can infiltrate thousands of systems downstream.
-
Mitigation is complex: Simply deleting the package isn’t enough. Users must rotate API keys, OAuth tokens, database credentials, and perform full audits to ensure no secondary backdoors remain.
This emerging threat demonstrates the need for improved automated scanning, stricter package vetting, and a greater emphasis on behavioral analysis of libraries. The developer community must become more vigilant, especially when integrating lesser-known or recently updated packages.
Fact Checker Results:
- The malicious PyPi packages and npm report have been independently confirmed by Socket and Sonatype.
- The download statistics and package names match data available from third-party tracking tools.
- Gmail and WebSocket usage in malware communication has been verified in previous advanced persistent threats (APTs).
Prediction:
Over the next year, the sophistication of malware hidden in open-source packages is likely to increase. Attackers will focus on exploiting highly trusted communication platforms like Gmail and Discord, while using encrypted channels to maintain persistent control. Expect a wave of developer-targeted attacks, especially aimed at DevOps engineers and blockchain application creators. Open-source ecosystems will need to enforce tighter controls and embrace real-time behavioral monitoring to counter this growing threat.
References:
Reported By: www.bleepingcomputer.com
Extra Source Hub:
https://www.discord.com
Wikipedia
Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
