Four rogue packages in the Python Package Index (PyPI) have been discovered to carry out a number of malicious actions, such as dropping malware and manipulating files. The packages were designed to purposely confuse people with well thought-out names. In addition, Fortinet FortiGuard Labs have found five different Python packages, which are engineered to harvest and exfiltrate sensitive information. These reports highlight the risk of nefarious packages in open-source repositories like npm and PyPi, which can have a severe impact on the software supply chain.
https://thehackernews.com/2023/02/researchers-uncover-obfuscated.html
