The Hidden Dangers in Open Source Libraries: A Closer Look at the Malicious Go Binary Hidden in a PyPI Package

In cybersecurity, attackers continually devise new methods to infiltrate systems and compromise data. A recent discovery by Phylum's automated risk detection platform highlights a sophisticated attack involving the Python Package Index (PyPI). This incident sheds light on the vulnerabilities inherent in open source ecosystems and emphasizes the need for vigilance among developers and users alike.

The Discovery

On May 10, 2024, an alert was triggered for a suspicious package named requests-darwin-lite on PyPI. At first glance, this package appeared to be a harmless fork of the well-known requests library. However, upon closer inspection, it was found to contain a malicious payload ingeniously hidden within a PNG file. This file, masquerading as a standard logo for the package, was not just any image—it was a staggering 17MB in size, compared to the legitimate logo's modest 300kB.

The Mechanism of Attack

The requests-darwin-lite package exploited a legitimate feature of Python’s setuptools—a cmdclass attribute that allows customization of commands during package installation. In the legitimate requests package, this feature is used to enhance the efficiency of running tests. In contrast, the malicious fork introduced a new class, PyInstall, specifically designed to execute only on macOS systems.

The attack process involved several sophisticated steps:

1. Base64 Decoding: Upon installation on a macOS, the PyInstall class decoded a base64 string that executed a command to extract the UUID of the system.
2. Targeted Execution: The script checked if the system’s UUID matched a pre-determined value. If matched, it indicated that the system was the specific target of the attack.
3. Data Extraction and Execution: The malicious script then read data from the oversized PNG file, extracting embedded binary data starting at a particular offset. This binary, a Go-based executable, was subsequently made runnable and executed silently in the background.

Implications and Insights

This attack highlights several critical points:

• Targeted Nature: The specificity of the UUID check suggests a highly targeted attack, possibly aimed at a particular individual or organization known to the attackers.
• Use of Steganography: By embedding malicious code within an image file, the attackers leveraged steganography to bypass casual security checks, which typically wouldn't flag a standard image file as suspicious.
• Evasive Tactics: The evolution of the package over several versions, from overtly malicious to benign, indicates a strategic approach to evade detection and possibly maintain a backdoor for future use.

Conclusion

The requests-darwin-lite incident is yet another reminder of the potential risks associated with open source software. While the Python community and platforms like PyPI are vigilant and proactive in addressing such threats, the sophistication and evasiveness of this attack highlight the need for enhanced security measures. Developers and users must remain acutely aware of the sources of the packages they use and employ comprehensive security strategies to protect against these increasingly complex threats.

For more detailed information and updates on this incident, visit Phylum's blog.