Beware of the ‘python-dateutils’ Malware!

Many of you might be familiar with the Python module ‘dateutil,’ a popular tool that extends Python’s standard datetime library. However, a recent alert from Sonatype’s automated malware detection system has uncovered a malicious package named ‘python-dateutils’ on PyPI. This package poses significant threats by mining Monero (XMR) cryptocurrency on your computer and stealing AWS credentials, regardless of whether you’re using Windows, Linux, or macOS.

What is Typosquatting?

The ‘python-dateutils’ package is a classic example of a typosquatting attack. Typosquatting involves naming a malicious package similar to legitimate ones, hoping that users will mistakenly download the wrong package. In this case, ‘python-dateutils’ mimics legitimate libraries like dateutil, python-dateutil, and dateutils. While there are some indications that ‘python-dateutils’ might have been legitimate in the past, the current versions have been identified as harmful.

Analyzing the Malicious Code

Obfuscation Techniques

Sonatype’s security research team has extensively studied thousands of malicious packages across various open-source ecosystems. During their analysis, they have encountered several obfuscation techniques used by cybercriminals, including steganography, Base64 encoding, and minification. The ‘python-dateutils’ package employs Base64 encoding combined with the ROT13 cipher for obfuscating text. ROT13 is a simple letter substitution cipher that replaces a letter with the 13th letter after it in the alphabet.

When examining the package’s setup.py manifest file, the obfuscation becomes evident:

The file contains hexadecimal representations of ASCII variable names, such as magic, love, and god, which are used in instructing the Python interpreter to evaluate the encoded code.

Below is a snippet from the decoded version of the ‘setup.py’ file:

Mining Monero (XMR)

The malicious package uses MoneroOcean’s GitHub repository to mine Monero cryptocurrency. The decoded script contains a Discord webhook (line 23) to exfiltrate data like your IP address, operating system information, and AWS credentials:

hXXps://discord[.]com/api/webhooks/991208558098141264/hLnYmQl9k38eM7PChAqZJzn6Jsele4fU04GLlaT-zfww0JdMw4j1zhazpUjBOjEuGzpA

From line 38 onwards, the script checks your operating system and loads the appropriate crypto miner, whether it’s a Bash or PowerShell version, from MoneroOcean’s GitHub repository. The attacker’s wallet address remains the same across platforms:

4AZ6u7wEVZ7EDFAXCnZGkf1PwRPMDStboTzzwJhf1LcJiK3Ki4H2SgjVCnFsgkwDoVa5De6zWQaXUcsEz1Hgu7b1LnvBTpu

Similar obfuscated code is also found in the src/dateutil/__init__.py file within the ‘python-dateutils’ package. Though the directory includes some legitimate code to camouflage the malware, the ‘__init__.py’ file echoes the suspicious ‘setup.py’ file.

Stealing AWS Credentials

Decoding the __init__.py file reveals the complete extent of the threat. Alongside mining Monero, the package uses the Discord webhook to exfiltrate your AWS credentials stored in ~/.aws/credentials. The exfiltration occurs when the ‘webhook’ function is called (lines 48, 52, and 56), sending the collected credentials, IP address, and system fingerprinting information to the endpoint.

Fortunately, Sonatype reported the package, and it was removed from the PyPI registry. According to PePy.tech, which tracks PyPI downloads, ‘python-utils’ was downloaded just under 1,000 times before being taken down.

Protecting Against Software Supply Chain Attacks

This discovery follows a series of recent disclosures about malicious Python packages stealing sensitive information. Sonatype continues to lead in open-source software security, ensuring the protection of developers, the ecosystem, and the software supply chain. The escalating number of malicious packages highlights the urgent need for automation in security measures.

Users of Sonatype Repository Firewall can have peace of mind, knowing that such harmful packages are automatically blocked from infiltrating their development builds.

Sonatype Repository Firewall instances automatically quarantine suspicious components detected by automated malware detection systems, while a manual review is conducted. This proactive approach ensures your software supply chain is protected from the outset.

Combining Sonatype’s top-tier security research data with their automated malware detection technology, developers, customers, and software supply chains are safeguarded against infections. The importance of such measures cannot be overstated, as open-source software security challenges continue to grow.

Image Credit: www.sonatype.com