The aiocpa PyPI Supply Chain Attack

What happened

The attacker published two poisoned releases of aiocpa to PyPI on 20 November 2024. The PyPI Security analysis says the project was created on 1 September 2024. Version 0.1.13 appeared at 18:04 UTC on 20 November. Version 0.1.14 followed at 18:50 UTC.

The malicious code was in cryptopay/utils/sync.py. It was wrapped in about 50 layers of obfuscation. These layers used byte encoding, compression, and reversal. When the library was imported, the code replaced the constructor of the CryptoPay class. It then sent the arguments, which include the API token, in an HTTP request to a Telegram bot.

ReversingLabs describes the layers as repeated Base64 encoding and zlib compression. ReversingLabs found the package on 21 November 2024 with machine learning threat hunting. It reported the package to PyPI. PyPI Security quarantined it that day at 18:29 UTC. PyPI published its analysis on 25 November 2024.

ReversingLabs reports more than 10,000 downloads before removal. The attackers did not copy the name of another package. They built a real crypto client first and attracted users. Then they poisoned later releases. ReversingLabs notes a takeover request for the project on 3 September 2024.

Affected versions

• aiocpa 0.1.13 (malicious, released 20 November 2024)
• aiocpa 0.1.14 (malicious, released 20 November 2024)
• aiocpa 0.1.0 to 0.1.12 (safe, according to PyPI Security)

PyPI quarantined the project. No clean release exists after 0.1.12. Treat any install of 0.1.13 or 0.1.14 as exposed.

Indicators of compromise

• Package name aiocpa at version 0.1.13 or 0.1.14.
• The file cryptopay/utils/sync.py, with the malicious code near line 44.
• Outbound requests to api.telegram.org with a /bot<id>/sendMessage path and chat_id=6526761736.
• SHA1 of 0.1.13 files listed by ReversingLabs: a1187d2a4acfe8ddaee3c7be79a9bb838142903a and 7007be259829d72e73ff63ad409770ca56cfc418.
• SHA1 of 0.1.14 files listed by ReversingLabs: fc36c157075dd4302f71ed2660e19a61016b085c and 01f7db47368bffa279fb15c688518774454650cf.

How to check

Run pip show in each Python environment, including virtual environments and containers. The command does not run the package.

pip show aiocpa
pip freeze | grep -i aiocpa

If the version is 0.1.13 or 0.1.14, the code ran when your program imported the library. Search your lock files and image layers too.

grep -rn aiocpa requirements*.txt poetry.lock Pipfile.lock pyproject.toml

What to do now

1. Remove aiocpa from every environment: pip uninstall aiocpa.
2. Revoke and replace every Crypto Pay API token that an affected program used. PyPI Security tells users to audit credentials the Telegram bot could have received.
3. Check your Crypto Pay account for payments you did not make.
4. Pin dependency versions and use hash checking, for example pip install --require-hashes. PyPI and ReversingLabs both give this advice.
5. Watch outbound network traffic from servers that hold payment keys.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 65

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    cryptopay/utils/sync.py
           It now downloads from the internet, reads saved passwords and access keys and runs other programs. It did not before.

Sources

1. blog.pypi.org/posts/2024-11-25-aiocpa-attack-analysis/
2. reversinglabs.com/blog/malicious-pypi-crypto-pay-package-aiocpa-implants-infostealer-code