(Source-hackread.com_.jpg)
A novel supply chain attack, dubbed “Revival Hijack,” has emerged, posing a significant threat to organizations using the Python Package Index (PyPI).PyPI Vulnerabilities. This new attack method, uncovered by JFrog’s software supply chain security team, leverages a vulnerability in PyPI’s package registration system to infiltrate downstream developer environments, potentially leading to the widespread distribution of malicious software.
Exploiting PyPI’s Package Registration PyPI Vulnerabilities
The attack method, Revival Hijack, focuses on hijacking removed PyPI packages by exploiting a re-registration feature. Once a package is removed from the PyPI index, it becomes available for registration by any user, making it susceptible to malicious actors. According to JFrog, there are approximately 309 package removals every month, providing ample opportunity for attackers to target vulnerable packages.
These packages may be removed due to lack of maintenance, a name change, or incorporation into official libraries. Attackers can seize these abandoned packages, upload malicious versions with the same name but higher versions, and infect developer environments when users update to the latest package. This tactic differs from traditional typosquatting attacks, as it doesn’t rely on user error but instead manipulates legitimate update processes.
JFrog’s security research team, including Andrey Polkovnychenko and Brian Moussalli, highlighted that developers often consider updating packages a safe operation. Unfortunately, this assumption allows malicious packages to be installed without warning, significantly increasing the risk to software supply chains.
JFrog’s Defensive Measures and PyPI Safeguards
Although PyPI Vulnerabilities has implemented measures to prevent impersonation and typosquatting, the Revival Hijack attack bypasses these safeguards. JFrog discovered that running the “pip list –outdated” command can present malicious packages as legitimate updates. Even more concerning, executing the “pip install –upgrade” command replaces the original package with the counterfeit version without alerting developers to any changes in the package author.
In response to the growing threat, JFrog took proactive steps to mitigate the risk. The company created a PyPI account named “security_holding” and re-registered vulnerable packages, replacing them with empty placeholders. This precaution prevents malicious actors from exploiting the removed packages. Each placeholder package is given a version number of 0.0.0.1 to ensure that developers do not accidentally pull the package during upgrades.
Evidence of the Attack in the Wild
Disturbingly, Revival Hijack has already been observed in real-world attacks. An unknown threat actor, identified as “Jinnis,” exploited the vulnerability by registering a benign version of a package called “pingdomv3” on March 30, 2024, the same day its original owner removed it from PyPI. On April 12, 2024, Jinnis released an updated version of the package containing a Base64-encoded payload that checks for the “JENKINS_URL” environment variable. If found, the package retrieves and executes an unknown module from a remote server, suggesting that the attackers may have delayed or targeted the attack.
JFrog noted that this new technique indicates a shift in strategy among threat actors, who are now focusing on supply chain attacks with a broader scope by targeting deleted PyPI packages. The company recommends that developers carefully inspect their DevOps pipelines to avoid installing packages that have been removed from the repository.
As the PyPI attack surface continues to grow, JFrog’s security team emphasized the importance of vigilance and proactive security measures. Developers are urged to stay alert and implement robust precautions to safeguard their systems from potential threats stemming from package hijacking.
Also Read: CyberPro Magazine
