Software supply chain attacks continue to threaten the developer ecosystem as threat actors find new ways to infiltrate popular open-source repositories.
In a recent discovery, security researchers at ThreatLabz identified a highly deceptive malicious package hosted on the Python Package Index (PyPI).
The threat actor uploaded a package named “parsimonius,” executing a classic typosquatting attack designed to impersonate the widely used and legitimate “parsimonious” parsing library.
Open-source repositories like PyPI are foundational to modern software development, but their open-access nature makes them frequent targets.
By dropping just a single letter from the legitimate name, the attackers successfully tricked developers into downloading their malicious code.
Developers typing quickly, copying installation commands from unverified sources, or simply misremembering the exact spelling of the library were the primary targets of this campaign.
To make the trap even more convincing, the attacker assigned the fake package a version number deliberately higher than the most current legitimate release. This versioning manipulation increases the likelihood of accidental installation.
Fake Parsimonious Package Spreads
To maintain persistence and avoid raising immediate alarms during the development cycle, the threat actor employed a clever cloaking technique.
Malicious packages that crash or fail to work often tip off developers immediately, leading to swift troubleshooting and reporting.
Recognizing this risk to their operation, the attackers incorporated the complete, legitimate parsing functionality of the original parsimonious package into their fake version.
When a developer imported the malicious package, their application continued to parse text and function exactly as intended.
This seamless integration ensured that routine unit tests passed and applications built successfully, completely masking the malicious activity running silently in the background.
While the application functioned normally on the surface, the package executed a hidden installation script upon deployment.
This script was responsible for establishing the primary payload, transforming a simple typographical error into a critical security breach for the affected development environment.
The core payload of this typosquatting campaign is a sophisticated backdoor that leverages the Telegram messaging platform for command-and-control communication.
Once the malicious package is initialized, it establishes a secure connection to an attacker-controlled Telegram bot.
Using Telegram for command and control is a popular evasion tactic, as the communication blends seamlessly with regular encrypted web traffic and bypasses traditional network monitoring solutions, ThreatLabz said.
Indicators of Compromise
| Indicator Type | Value | Details |
|---|---|---|
| Malicious package name | parsimonius | Uploaded to PyPI to impersonate the legitimate package through typosquatting. |
| Legitimate package name | parsimonious | The fake package was crafted to resemble the real Python parsing library by changing a single character. |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
