The aiocpa PyPI Supply Chain Attack

What happened

The attackers built a real crypto client first and then added malware in a later release. The ReversingLabs analysis says they did not copy an existing package name. They published their own tool to gain users and then pushed a bad update.

The PyPI analysis gives this timeline:

• 20 Nov 2024, 18:04 UTC: version 0.1.13 is published.
• 20 Nov 2024, 18:50 UTC: version 0.1.14 is published.
• 21 Nov 2024, 16:18 UTC: a ReversingLabs researcher reports the package.
• 21 Nov 2024, 18:29 UTC: PyPI quarantines it.
• 25 Nov 2024: PyPI publishes its analysis.

The malicious code sits in cryptopay/utils/sync.py at about line 44. PyPI describes about 50 layers of obfuscation with byte encoding, compression and reversals. ReversingLabs describes recursive Base64 and zlib layers. When the code runs, it takes over the CryptoPay constructor. It sends the tokens and API server details passed to the client to the attacker's Telegram bot.

PyPI notes that the project's GitHub repository held clean code. The malware was only in the published packages. ReversingLabs reports more than 10,000 downloads before removal.

Affected versions

• Malicious: aiocpa 0.1.13 and 0.1.14.
• Clean per PyPI: 0.1.0 through 0.1.12.
• No patched release exists. All affected versions were removed from PyPI.

The advisory GHSA-486g-47cc-8wxf lists a severity of High (CVSS 8.3) and no CVE.

Indicators of compromise

• Package name aiocpa at version 0.1.13 or 0.1.14. The internal module name is cryptopay.
• Heavily obfuscated Base64 and zlib code in cryptopay/utils/sync.py.
• SHA1 of the 0.1.13 file listed by ReversingLabs: a1187d2a4acfe8ddaee3c7be79a9bb838142903a
• SHA1 of the 0.1.14 file listed by ReversingLabs: 01f7db47368bffa279fb15c688518774454650cf
• Outbound requests to a Telegram bot API endpoint when your code creates the Crypto Pay client.

ReversingLabs lists the hashes as a partial list. The sources do not give the bot token or chat id.

How to check

Check whether aiocpa is installed and which version.

pip show aiocpa

Search every environment, lockfile and requirements file for the package.

grep -rniE "aiocpa==?0\.1\.1[34]" . --include="*.txt" --include="*.lock" --include="*.toml"

Do not import the package to test it. Importing runs the obfuscated code.

What to do now

1. Uninstall aiocpa from every environment with pip uninstall aiocpa.
2. Revoke and replace every Crypto Pay API token that you passed to the client.
3. Review your Crypto Pay account for unexpected activity.
4. Pin dependency versions with hash checking so that an unexpected release cannot install silently.
5. Monitor outbound network traffic from build and production hosts.

Vigilance compares the version you trust with a new one. Here, sync.py gained multi-layer decode-and-execute code and an outbound send of client arguments. That is a new capability in a file that held plain library code in 0.1.12.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 10

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    cryptopay/utils/sync.py
           It now reads saved passwords and access keys and runs other programs. It did not before.

Sources

1. blog.pypi.org/posts/2024-11-25-aiocpa-attack-analysis/
2. github.com/advisories/GHSA-486g-47cc-8wxf
3. reversinglabs.com/blog/malicious-pypi-crypto-pay-package-aiocpa-implants-infostealer-code