VMConnect: Malicious PyPI packages imitate popular open source modules

ReversingLabs has reported that several Python packages in the Python Package Index (PyPI) open-source repository are imitating popular open-source Python tools with malicious intentions. The campaign implementing the deception began around 28 July 2023. The researchers also discovered that security assessments of open-source code repositories often fail to detect these nuanced attacks. The ReversingLabs team continuously monitors open-source package repositories to detect malicious code or supply chain issues. This latest episode is typical of attacks on the PyPI platform.