<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
Hello,
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">I hope everyone is doing well!</div>
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">Below is the entry for today.</div>
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">11/07/2022 - Diary entry #622:</div>
<div><br class="ContentPasted0">
</div>
<blockquote style="margin-top:0;margin-bottom:0">
<div class="ContentPasted0 ContentPasted1">In our Daily Diary entry #517, we talked about Repository Typosquatting, a technique used to infect systems based on typos on package managers such as PyPi – the Python Package Index – the official third-party repository
for Python libraries. The lack of moderation in PyPi and other package repositories makes it susceptible to Typosquatting. Threat actors just need to upload a malware with a similar name and wait for someone to install it by accident.
<div><br class="ContentPasted1">
</div>
<div class="ContentPasted1">That’s exactly what happened in this new campaign. Twenty-nine packages designed to infect developers’ systems with an info-stealing malware called W4SP Stealer were discovered in the PyPI repository, being downloaded over 5,700
times. The attackers basically copied existing popular libraries and injected a malicious import statement into either the setup.py or the init.py file.</div>
<div><br class="ContentPasted1">
</div>
<div class="ContentPasted1">W4SP Stealer is an open-source Python-based trojan capable of exfiltrating files of interest, passwords, browser cookies, system metadata, Discord tokens, and cryptocurrency wallets. Earlier in August this year, two other malicious
packages were observed deploying this same malware family.</div>
<div><br class="ContentPasted1">
</div>
That's why dependencies and third-party libraries should never be blindly trusted. Developers should validate what they are installing and, preferably, use fixed versions in their projects, as not rarely trusted libraries are infected and can deliver malicious
code through updates.<br>
</div>
</blockquote>
<div><br class="ContentPasted0">
</div>
Kind Regards,<br>
</div>
<div class="elementToProof">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="font-size:medium; font-family:"Times New Roman"">
<tbody>
<tr>
<td style="width:180px" align="left">
<table width="120" align="left">
<tbody>
<tr>
<td colspan="3" align="center"><a href="https://www.appgate.com/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="120" height="30" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png"></a></td>
</tr>
<tr>
<td colspan="3" align="center"> </td>
</tr>
<tr>
<td width="37%" align="center"><a href="https://www.linkedin.com/company/appgate-security/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="18" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png"></a></td>
<td width="28%"><a href="https://twitter.com/AppgateSecurity" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="20" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png"></a></td>
<td width="35%"><a href="https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="width: 26px; height: 18px; max-width: initial;" width="26" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png"></a></td>
</tr>
</tbody>
</table>
<p style="margin-top:0px; margin-bottom:0px"> </p>
</td>
<td colspan="2" rowspan="2" style="width:350px">
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<strong>MART</strong><br>
</p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
Malware Analysis and Research Team<br>
<strong>Appgate</strong></p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
E:<span style="margin:0px"> <a href="mailto:ctas-mat@appgate.com" title="mailto:ctas-mat@appgate.com">
ctas-mat@appgate.com</a></span><br>
</p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<span style="margin:0px; background-color:white"><br>
</span></p>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>