Python libraries containing malicious code collect and upload users' Amazon Web Services credentials

[Rual dV]

Malicious Python packages stole users' Amazon Web Services credentials

Sonatype researchers discovered malicious code in multiple Python packages that uploaded users' Amazon Web Services (AWS) credentials and environment variables to a publicly exposed domain.

Sonatype's automated malware detection system initially discovered the malicious packages, after which the company's researchers reported them to the Python Package Index (PyPI) team.

 

[Guest 290922]

Open source man, it's the wild west of the 22nd century.

 

[prod]

Seems to happen pretty frequently, how many packages are out there that we don't know about?

Just a month ago:

https://www.reddit.com/r/Python/comments/uwhzkj

Though, I'm pretty sure most companies would require you to comb through any packages you import in your projects...right?