Security Experts:

Connect with us

Hi, what are you looking for?



Python, JavaScript Developers Targeted With Fake Packages Delivering Ransomware

Phylum security researchers warn of a new software supply chain attack relying on typosquatting to target Python and JavaScript developers.

Phylum security researchers warn of a new software supply chain attack relying on typosquatting to target Python and JavaScript developers.

On Friday, the researchers warned that a threat actor was typosquatting popular PyPI packages to direct developers to malicious dependencies containing code to download payloads written in Golang (Go).

The purpose of the attack is to infect victims with ransomware variants designed to update the desktop background with a message impersonating the CIA and instructing the victim to open a ‘readme’ file. The malware also attempts to encrypt some of the victim’s files.

The ‘readme’ file is, in fact, a ransom note that tells the victim they need to pay the attackers $100 in cryptocurrency to receive a decryption key.

Phylum has compiled a list of packages targeted in the campaign. As of Friday, the list included: dequests, fequests, gequests, rdquests, reauests, reduests, reeuests, reqhests, reqkests, requesfs, requesta, requeste, requestw, requfsts, resuests, rewuests, rfquests, rrquests, rwquests, telnservrr, and tequests.

Shortly after publishing the initial report, Phylum updated it to warn that NPM packages were also being targeted as part of the same campaign.

The identified malicious NPM packages – such as discordallintsbot, discordselfbot16, discord-all-intents-bot, discors.jd, and telnservrr – contain JavaScript code that behaves similarly with the code identified in the Python packages.

According to Phylum CTO Louis Lang, the number of malicious packages is expected to increase. The binaries dropped by these packages are identified as malware by the antivirus engines in VirusTotal.

Related: LofyGang Cybercrime Group Used 200 Malicious NPM Packages for Supply Chain Attacks

Related: Researchers Spot Supply Chain Attack Targeting GitLab CI Pipelines

Related: Checkmarx Finds Threat Actor ‘Fully Automating’ NPM Supply Chain Attacks

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Management & Strategy

Industry professionals comment on the recent disruption of the Hive ransomware operation and its hacking by law enforcement.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...


US government reminds the public that a reward of up to $10 million is offered for information on cybercriminals, including members of the Hive...


The Hive ransomware website has been seized as part of an operation that involved law enforcement in 10 countries.