Sonatype has identified multiple malicious Python packages that contain ransomware scripts. These packages are named after a legitimate, widely known library called ‘Requests.’

While incidences of malware infiltrating open source repositories are hardly surprising, as we’ve repeatedly seen, it’s not often we come across open source packages dropping ransomware. Last we saw this was in 2021 when we spotted npm typosquats launching MBRLocker ransomware.

Type Your Requests Carefully

Sonatype’s automated malware detection system, an integral part of our Nexus Firewall offering, has detected the following malicious PyPI packages. These packages contain ransomware scripts, and have been assigned sonatype-2022-4350 in our security research data.

• requesys
• requesrs
• requesr

This means any developer who intends to install or include the ‘requests’ library in their package but inadvertently mistypes its spelling could instead end up with one of these malicious packages and get infected with ransomware.

These packages were analyzed by my colleague and Senior Security Researcher, Ankita Lamba.

Particularly, all versions of the ‘requesys’ package contain scripts that traverse a Windows user’s folders, such as “Documents,” “Downloads,” “Pictures,” and begin encrypting files.

Versions 1.0-1.4 of ‘requesys’ contain the encryption and decryption code laid out in plaintext Python. But, version 1.5 packs a base64-obfuscated EXEcutable (analyzed in the subsequent section) that makes analysis a tad more challenging.

The program uses Python’s ‘Fernet‘ module of the cryptography package to achieve symmetric key encryption. Fernet is also used to randomly generate the encryption key (line 29 below) which is also used for decryption by the victim.

Should the program run successfully, a popup message would appear on the user’s screen, further instructing them to contact the package author b8ff aka “OHR (Only Hope Remains)” via their Discord server:

“IF YOU CLOSE THIS WINDOW YOUR FILES WILL BE ENCRYPTED FOREVER

Ooops… Your files are (Read more...)