{"uuid": "f7d17e18-3ff3-4cdd-9747-d7128be66abb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31313", "type": "seen", "source": "https://t.me/hacking_Attack/57174", "content": "Black Hat Ethical Hacking\nPyPI package \u2018keep\u2019 mistakenly included a password stealer\n\nPyPI package \u2018keep\u2019 mistakenly included a password stealerPost Views: 54 \nPremium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.\nReading Time: 4 Minutes\nPyPI packages \u2018keep,\u2019 \u2018pyanxdns,\u2019 \u2018api-res-py\u2019 were found to\u00a0be containing\u00a0a\u00a0backdoor due to the presence of malicious \u2018request\u2019 dependency within some\u00a0versions.\nFor example, while most versions of \u2018keep\u2019 project\u00a0use the legitimate Python module requests\u00a0for making HTTP requests, \u2018keep\u2019 v.1.2 contains \u2018request\u2019 (without s) which is\u00a0malware.\n\nBleepingComputer reached out to the authors of each of these packages to understand if this was caused by a\u00a0mere typographical error,\u00a0\u00a0self-sabotage,\u00a0or by maintainer accounts getting hijacked. PyPI package \u2018keep\u2019 uses malicious \u2018request\u2019Some versions of PyPI packages, \u2018keep,\u2019\u00a0\u2018pyanxdns,\u2019 and \u2018api-res-py\u2019 were caught using a malicious dependency,\u00a0\u2018request,\u2019\n\nBack in May, GitHub user duxinglin1\u00a0noticed\u00a0the\u00a0vulnerable versions contained the misspelled\u00a0\u2018request\u2019 dependency, as opposed to the legitimate requests\u00a0library.\n\nAs such, the following CVEs have been assigned this week with regards to the vulnerable versions:\n\n* CVE-2022-30877\u00a0\u2013\u00a0\u2018keep\u2019\u00a0version 1.2 contains the backdoor \u2018request\u2019, contrary to what the advisory implies.\n* CVE-2022-30882\u00a0\u2013 \u2018pyanxdns\u2019 version 0.2 impacted\n* CVE-2022-31313\u00a0\u2013 \u2018api-res-py\u2019 version 0.1 impacted\n\nAlthough \u2018pyanxdns\u2019 and \u2018api-res-py\u2019 might be small scale projects,\u00a0\u00a0the \u2018keep\u2019 package, in particular, gets downloaded over\u00a08,000\u00a0times\u00a0in a week on average\u2014with its version 1.2 using the malicious dependency:\nhttps://www.bleepstatic.com/images/news/u/1164866/2022/jun-2022/pypi-request-keep-backdoor/pypi-keep-page.jpeg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:46.826144Z"}