Socket researchers discovered seven malicious PyPI packages impersonating "Coffin" that accumulated 55,000+ downloads over four years. The malware used Gmail SMTP servers for initial reconnaissance and WebSockets for persistent access, enabling attackers to execute commands, exfiltrate dat...
Two malicious PyPI packages impersonating DeepSeek AI tools were discovered, targeting developers to steal sensitive data including API keys, credentials, and access tokens. The packages, downloaded 222 times across multiple countries, have been removed from PyPI. Affected users are advise...
A significant security incident occurred involving two malicious Python packages on PyPI that impersonated popular AI models (ChatGPT and Claude AI). The packages, named "gptplus" and "claudeai-eng," were uploaded by a user called "Xeroline" in November 2023 and accumulated over 3,500 down...
