Fake Python Libraries Caught Trying to Steal SSH and GPG Keys

A couple of Python libraries that posed as real components were caught stealing SSH and GPG keys from projects that used them.

Software developer Lukas Martini discovered that the python3-dateutil and jeIlyfish libraries in the PyPI (Python Package Index) were actually designed to imitate the real dateutil and jellyfish packages to steal the SSH and GPG keys.

The two libraries had different names than the originals, with jeIlyfish differing only by one letter. This type of mechanic has a long history of use on Unix environments, but it”s not exclusive. The most worrying aspect is that, while python3-dateutil was only available for two days, the fake jeIlyfish library stayed up for more than a year.

“Just a quick heads-up: There is a fake version of this package called python3-dateutil on PyPI that contains additional imports of the jeIlyfish package (itself a fake version of the jellyfish package, that first L is an I),” said Martini. “I’ve sent an email to the Python security team and hope they’ll take the package (as well as the other ones by the user) down soon, but in the meantime it might be a good idea to check if you have the correct version installed.”

According to ZDNet, dateutil developer Paul Ganssle analyzed the files and determined that python3-dateutil called for the installation and use of jeIlyfish, which would try to find SSH and GPG from the project and send them to the IP address http://68.183.212.246:32258.

While the PyPI project removed the libraries, developers still using them should purge their repositories and make sure they are not in use.