A pernicious potpourri of Python packages in PyPI

ESET Research has found 116 malicious Python packages on the Python Package Index (PyPI), the official Python package repository. The packages were downloaded over 10,000 times and delivered backdoor malware that targeted both Windows and Linux systems. The backdoor allowed for remote command execution, exfiltrating files, and screenshooting. In some cases, the payload also stole cryptocurrency or delivered the W4SP Stealer. The malware was disguised within legitimate-looking projects and was often installed via social engineering.