Last week, Sonatype discovered a dubious package ‘vapi-client-bindings’ published to the PyPI open source repository. The discovery was made by Sonatype’s automated malware detection bots.

The package contained proof-of-concept (PoC) dependency confusion code that we have now repeatedly seen in tens of thousands of open source packages.

Further analysis uncovered that the package is in fact used by VMWare’s VSphere automation SDK as a dependency, prompting Sonatype to notify the PyPI registry to take down the package.

VMWare has confirmed no impact to its products or users of the VSphere SDK dependency thus far.

A real VMWare VSphere SDK dependency

On March 26th, Sonatype’s automated malware detection bots flagged a suspicious Python package called: ‘vapi-client-bindings’—the same day it was published to PyPI.

This package is recorded under the sonatype-2022-1754 identifier in our security research data.

Although at first glance the name ‘vapi-client-bindings’ may not raise alarms or reveal any obvious insight, it turns out it is a legitimate (internal) dependency used by VMWare VSphere Automation SDK.

And, time and time again, developers who’ve had trouble finding or working with this dependency, have raised issues on VMWare’s GitHub [1, 2]:

Naturally, if multiple issues have been raised on GitHub about an internal (private) dependency, it doesn’t take long for a pentester, bug bounty hunter, or malicious actor to squat the dependency on a public open source registry as well.

Ethical hacker targets VMware

In this particular case, Ukraine-based ethical hacker and bug bounty hunter, Vladyslav Kotko aka ‘kotko‘ published the ‘vapi-client-bindings’ on PyPI last week.

The inside of ‘vapi-client-bindings’ comprises simple code that uploads your IP address, hostname, working directory path, and basic system fingerprinting information to the researcher’s domain, “kotko[.]me.”

As we explained last year, “the dependency confusion problem is an inherent design (Read more...)