MAL-2024-10038 Malicious code in jupiterhelper (PyPI)
- Package
- jupiterhelper
- Registry
- PyPI
What is MAL-2024-10038?
MAL-2024-10038 is a malicious package in jupiterhelper, published on 10 Aug 2024.
Official description
Once run, downloads and install from sleipnirbrowser[.]org a suspicious executable pretending to be a webbrowser. This website appears to be a scam using some kind of crypto tokens, and trying to impersonate a legitimate Slepnir web browser (https://en.wikipedia.org/wiki/Sleipnir_(web_browser)).
Later versions switched to install a software identified as LUMMA infostealer (e.g. https://tria.ge/240817-whze2aydkc), hidden in different executables
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2024-08-sleipnirbrowser-web3
Reasons (based on the campaign):
Downloads and executes a remote executable.
dependency-confusion
crypto-related
modify-system-without-consent
impersonation
What should I do about MAL-2024-10038?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.