Sonatype discovered multiple Python packages that exfiltrate your secrets: AWS credentials and environment variables.
The loot ended up in hundreds of text files on the exfiltration endpoint, readable by anyone who knew where to look.
Additionally, quite a few CVEs popped up in NVD with a reference to the malicious request package.
BleepingComputer reported that keep, pyanxdns and api-res-py pulled in this typosquat of requests, apparently through typos in their dependency lists, which earned keep 1.2 CVE-2022-30877.
A user had flagged the backdoor in the keep issue tracker back in May, noting that PyPI mirrors still served the malicious package after PyPI removed it.
One missing “s”, and your users get a RAT and an info-stealer.
