A malicious PyPI package was used to install a Monero cryptominer on Linux systems. . The package in question, secretslib, was pushed to the official third-party software repo for Python on 6th August 2022. The package was described as “secrets matching and verification made easy”. Sonatype’s automated malware detection system flagged secretslib as potentially malicious. Further analysis proved its suspicions to be correct. The link for this article located at Developer is no longer available. . An exploitative package on PyPI dubbed pycryptominer was discovered deploying a Zcash mining tool across Linux platforms.. Linux Cryptominer Threat, PyPI Malware, Malicious Package Installation. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.