A recently discovered malicious package hiding within the Python Package Index (PyPI) has been silently stealing AWS credentials for years, exposing thousands of developers to potential data breaches.
The package, named “fabrice,” is a typosquatted version of the popular “fabric” library, designed to exploit developers who mistype the library name.
Researchers found that since 2021, “fabrice” has recorded over 37,000 downloads, primarily targeting Amazon Web Services (AWS) credentials, before finally being detected as malicious.
PyPI’s Ongoing Battle with Typosquatting Packages
Typosquatting, where malicious actors create packages with names similar to popular libraries, is a tactic increasingly used on PyPI, a global repository used daily by millions of developers.
Attackers capitalize on minor typing errors, hoping developers unknowingly download their harmful packages instead of legitimate ones.
In the case of “fabrice,” attackers copied the appearance and some functionality of the real “fabric” library, a tool used for SSH-based remote server management and automating multi-server operations.
This malicious clone worked seamlessly on both Windows and Linux, enabling a broad attack surface while staying undetected for three years.
How Fabrice Stole AWS Credentials
The main objective of “fabrice” was to access and steal AWS credentials from unsuspecting developers. AWS credentials grant access to Amazon Web Services accounts and can expose a wealth of sensitive data and resources.
When unsuspecting users imported or interacted with “fabrice” in their code, it secretly collected the AWS login information.
The package then exfiltrated this data through a VPN connection to a server located in Paris, France, further obscuring the source and complicating tracing efforts.
The VPN server involved appears to be managed by a reputable cloud and connectivity provider, M247.
Although M247 does not appear to be implicated directly, the use of their infrastructure made it challenging for security teams to trace or halt data leaks in real-time.
A Systemic Vulnerability: The Need for PyPI Scanning Updates
The attack highlights a longstanding vulnerability in the Python Package Index. Although PyPI implemented new security scanning tools for uploaded packages, these were not applied retroactively.
Consequently, “fabrice” and other typosquatting malware packages published prior to these measures could remain on the platform undetected.
The sheer volume of packages hosted on PyPI—a half-million and counting—makes comprehensive scanning a resource-intensive process.
Additionally, typosquatted packages that mirror legitimate packages add to the challenge, as automated systems may fail to distinguish them without deeper code analysis.
How to Protect Against Typosquatted Malware in PyPI
This incident underscores the importance of exercising caution and scrutiny when downloading libraries or packages. Companies can use several strategies to protect their resources:
- Enhanced Vigilance in Downloading Packages
Developers should double-check package names and verify sources, especially for critical projects. Avoiding reliance on command-line installations for popular libraries and instead verifying the PyPI pages directly can mitigate typosquatting risks. - Implementing AWS IAM and Least Privilege Access
Using AWS Identity and Access Management (IAM) to limit permissions is a proactive approach to reduce exposure. By restricting access based on specific roles or needs, organizations can minimize the damage from potential credential thefts. - Security Audits and Dependency Scanners
Regular code audits and dependency scanners, particularly those that scan for typosquatting attempts or known malicious signatures, can help catch suspect libraries before they cause damage.
The Broader Threat of Typosquatting in Software Supply Chains
Typosquatting has been a persistent issue within the software supply chain. PyPI, along with other open-source repositories like npm, have experienced repeated attacks that exploit minor mistakes developers make when typing in package names.
These attacks aim to spread malware, hijack credentials, and steal data at a scale that impacts organizations globally.
For example, the original “fabric” library—highly trusted with over 200 million downloads—was specifically targeted by the “fabrice” package, demonstrating how typosquatting exploits can threaten the security of even the most popular and widely used development tools.
The ease with which attackers can plant malicious code in popular repositories remains a significant concern, with experts calling for more robust protections.
