BleepingComputer reports that 241 typosquatted npm and PyPI packages imitating libraries such as React, argparse and AIOHTTP installed the XMRig Monero miner on Linux machines.
Researcher Hauke Lübbers flagged 55 of the PyPI projects (33 at first, then 22 more the actor uploaded while he was reporting them), and Sonatype found 186 npm packages calling the same malicious URL.
Sonatype’s own write-up adds that all 186 npm packages came from a single account, “17b4a931”, and pull in the legitimate http-errors library so they behave as expected while the miner script runs silently.
The Python packages simply os.system a wget of a bit.ly link that serves a Bash script, which downloads and starts the miner and reports the victim’s IP address back home.
Both registries pulled the packages quickly, but one fat-fingered pip install is still all it takes to donate your CPU to someone else’s Monero wallet.
