Which versions of alibabacloud-oss2 are malicious?

Every published version of alibabacloud-oss2 on PyPI is considered malicious. Remove the package entirely.

How do I remediate alibabacloud-oss2 if I installed it?

Remove alibabacloud-oss2 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed alibabacloud-oss2 — how do I know if it already compromised me?

If alibabacloud-oss2 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

How do I find alibabacloud-oss2 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for alibabacloud-oss2 (all published versions).

Malicious package

alibabacloud-oss2PyPI

alibabacloud-oss2 is a confirmed malicious PyPI package (MAL-2023-8353) that executes malicious code on install. Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in alibabacloud-oss2 (PyPI)

MAL-2023-8353

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall alibabacloud-oss2

What this malware does

Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI.

The malicious code was hidden in strategicly chosen functions and would only trigger when these functions were called. The malicious code does not automatically run on install or import, helping the packages evade detection.

Malicious versions

all versions

Every published version of this package is considered malicious — remove it entirely.

Indicators of compromise (SHA-256)

d804868504b96ba968b7eae99df63e235a0eaa2eab4a7951ae02c98c614f1828

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for alibabacloud-oss2 (all published versions).
If you installed it — respond
Remove alibabacloud-oss2 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If alibabacloud-oss2 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. alibabacloud-oss2 on PyPI has been identified as a malicious package (all published versions flagged). It should be removed immediately — do not install or keep it in your dependency tree.

References

blog.phylum.io

Credits

Phylum · finder

Detect & block this

O3 blocks alibabacloud-oss2-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database