Check Point finds ten info-stealer packages on PyPI

Check Point Research found ten malicious packages on PyPI that run info-stealers straight from setup.py at install time and ship passwords, environment variables and credentials off to Discord webhooks and attacker-controlled domains. The line-up includes ascii2text, a copy of the popular art package, zlibsrc for anyone unsure whether zlib is built in, and WINRPCexploit, which promises a Windows RPC exploit and only exploits whoever installs it. pyg-utils looks like a leftover of the PyGrata campaign, in which Sonatype caught packages in June uploading IAM credentials from the EC2 metadata service and environment variables to pygrata.com, where hundreds of stolen files sat readable by anyone. pymocks and PyProto2 carry near-identical code aimed at a freshly registered pymocks.com, probably the same actor starting over. A pip install is arbitrary code execution with extra steps, so maybe read the package before you hand it your AWS keys.