Connect with us

Hi, what are you looking for?



Python, JavaScript Developers Targeted With Fake Packages Delivering Ransomware

Phylum security researchers warn of a new software supply chain attack relying on typosquatting to target Python and JavaScript developers.

Phylum security researchers warn of a new software supply chain attack relying on typosquatting to target Python and JavaScript developers.

On Friday, the researchers warned that a threat actor was typosquatting popular PyPI packages to direct developers to malicious dependencies containing code to download payloads written in Golang (Go).

The purpose of the attack is to infect victims with ransomware variants designed to update the desktop background with a message impersonating the CIA and instructing the victim to open a ‘readme’ file. The malware also attempts to encrypt some of the victim’s files.

The ‘readme’ file is, in fact, a ransom note that tells the victim they need to pay the attackers $100 in cryptocurrency to receive a decryption key.

Phylum has compiled a list of packages targeted in the campaign. As of Friday, the list included: dequests, fequests, gequests, rdquests, reauests, reduests, reeuests, reqhests, reqkests, requesfs, requesta, requeste, requestw, requfsts, resuests, rewuests, rfquests, rrquests, rwquests, telnservrr, and tequests.

Shortly after publishing the initial report, Phylum updated it to warn that NPM packages were also being targeted as part of the same campaign.

The identified malicious NPM packages – such as discordallintsbot, discordselfbot16, discord-all-intents-bot, discors.jd, and telnservrr – contain JavaScript code that behaves similarly with the code identified in the Python packages.

According to Phylum CTO Louis Lang, the number of malicious packages is expected to increase. The binaries dropped by these packages are identified as malware by the antivirus engines in VirusTotal.

Advertisement. Scroll to continue reading.

Related: LofyGang Cybercrime Group Used 200 Malicious NPM Packages for Supply Chain Attacks

Related: Researchers Spot Supply Chain Attack Targeting GitLab CI Pipelines

Related: Checkmarx Finds Threat Actor ‘Fully Automating’ NPM Supply Chain Attacks

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.


SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.


People on the Move

Former DoD CISO Jack Wilmer has been named CEO of defensive and offensive cyber solutions provider SIXGEN.

Certificate lifecycle management firm Sectigo has hired Jason Scott as its CISO.

The State of Vermont has appointed John Toney as the state’s new CISO.

More People On The Move

Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.


A SaaS ransomware attack against a company’s Sharepoint Online was done without using a compromised endpoint.