Socket’s threat research team has uncovered seven malicious PyPI packages that leveraged Gmail’s SMTP servers and WebSockets to exfiltrate data and execute remote commands. These packages, which impersonated the legitimate “Coffin” package for Django projects, collectively amassed over 55,000 downloads before their removal from PyPI.

## Discovered Malicious Packages

The identified packages include:
– Coffin-Codes-Pro (9,000 downloads)
– Coffin-Codes-NET2 (6,200 downloads)
– Coffin-Codes-NET (6,100 downloads)
– Coffin-Codes-2022 (18,100 downloads)
– Coffin2022 (6,500 downloads)
– Coffin-Grave (6,500 downloads)
– cfc-bsb (2,900 downloads)

Some of these packages remained undetected on PyPI for over four years.

## Sophisticated Attack Methodology

The malware operated through a two-stage attack:

1. **Initial Access**: The packages used hardcoded Gmail credentials to connect to Gmail’s SMTP server, sending reconnaissance information about compromised systems. This communication typically bypassed security controls since Gmail is a trusted service.

2. **Persistent Access**: After initial contact, the malware established an encrypted WebSocket connection over SSL to receive tunnel configuration instructions, creating a bidirectional tunnel between the victim and attacker.

This sophisticated setup enabled attackers to:
– Access internal admin panels and APIs
– Transfer files
– Exfiltrate emails
– Execute shell commands
– Harvest credentials
– Facilitate lateral movement

## Cryptocurrency Theft Indicators

Strong evidence suggests these packages targeted cryptocurrency theft. The attackers used email addresses like “[email protected]” and employed tactics previously seen in Solana private key theft operations.

## Related NPM Package Discovered

In a parallel discovery, Sonatype identified “crypto-encrypt-ts” in the NPM repository, which masqueraded as a TypeScript version of the popular CryptoJS library. This package specifically targeted cryptocurrency wallets with balances exceeding 1,000 units, attempting to steal private keys through cron job persistence.

## Remediation Advice

Organizations that have installed any of these packages should immediately:
– Remove the malicious packages
– Rotate all keys and credentials
– Scan for persistent access mechanisms
– Review logs for suspicious activity

This discovery highlights the ongoing security challenges in open-source package repositories and the sophisticated techniques attackers use to maintain persistent access to compromised systems.