{"vulnerability": "CVE-2022-30882", "sightings": [{"uuid": "eaf9cedb-383c-49cf-8d47-f76c8c76294d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30882", "type": "seen", "source": "https://t.me/itsec_news/819", "content": "\u200b\u26d4\ufe0f \u041f\u0430\u043a\u0435\u0442\u044b PyPI \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u0431\u044d\u043a\u0434\u043e\u0440.\n\n\ud83d\udcac \u041f\u0430\u043a\u0435\u0442\u044b PyPI \u00abkeep\u00bb, \u00abpyanxdns\u00bb, \u00abapi-res-py\u00bb \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u0431\u044d\u043a\u0434\u043e\u0440 \u0438\u0437-\u0437\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u00abrequest\u00bb.\n\n\u0411\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0432\u0435\u0440\u0441\u0438\u0439 \u043f\u0430\u043a\u0435\u0442\u0430 \u00abkeep\u00bb \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b (requests) Python \u043c\u043e\u0434\u0443\u043b\u044f \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u043f\u0430\u043a\u0435\u0442 \u00abkeep\u00bb v.1.2 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u00abrequest\u00bb (\u0431\u0435\u0437 s ), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044c \u00abrequest\u00bb \u0442\u0430\u043a\u0436\u0435 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 PyPI-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u00abpyanxdns\u00bb \u0438 \u00abapi-res-py\u00bb.\n\n\u0412 \u043c\u0430\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c GitHub duxinglin1 \u0437\u0430\u043c\u0435\u0442\u0438\u043b, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044c \u00abrequest\u00bb \u0441 \u043e\u0448\u0438\u0431\u043a\u043e\u0439, \u0430 \u043d\u0435 \u0437\u0430\u043a\u043e\u043d\u043d\u0443\u044e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 (requests).\n\n\u0411\u044b\u043b\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438:\n\n\u2014 CVE-2022-30877 \u2014 \u043f\u0430\u043a\u0435\u0442 \u00abkeep\u00bb \u0432\u0435\u0440\u0441\u0438\u0438 1.2 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u00ab\u0437\u0430\u043f\u0440\u043e\u0441\u00bb \u0431\u044d\u043a\u0434\u043e\u0440\u0430;\n\u2014 CVE-2022-30882 \u2014 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442 \u043f\u0430\u043a\u0435\u0442 \u00abpyanxdns\u00bb \u0432\u0435\u0440\u0441\u0438\u0438 0.2;\n\u2014 CVE-2022-31313 \u2014 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442 \u043f\u0430\u043a\u0435\u0442 \u00abapi-res-py\u00bb \u0432\u0435\u0440\u0441\u0438\u0438 0.1.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u0430\u043a\u0435\u0442\u0430 \u00abpyanxdns\u00bb \u041c\u0430\u0440\u043a \u042d\u0433\u0435\u0431\u0435\u043a \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b, \u0447\u0442\u043e \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u0430 \u0438\u0437-\u0437\u0430 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0438, \u0430 \u043d\u0435 \u0438\u0437-\u0437\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438. \u0412\u0438\u0434\u0438\u043c\u043e, \u0430\u0432\u0442\u043e\u0440\u044b \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u00abkeep\u00bb \u0438 \u00abapi-res-py\u00bb \u0442\u0430\u043a\u0436\u0435 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u043e \u0432\u0432\u0435\u043b\u0438 \u00abrequest\u00bb \u0432\u043c\u0435\u0441\u0442\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0433\u043e \u00abrequests\u00bb \u0438\u0437-\u0437\u0430 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0438. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u043b \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0432 PyPI \u0438 \u0443\u0434\u0430\u043b\u0438\u043b \u0432\u0435\u0440\u0441\u0438\u044e, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u0441\u044b\u043b\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044c \u00abrequest\u00bb.\n\n#PyPi #\u0411\u044d\u043a\u0434\u043e\u0440\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2022-06-13T17:50:52.000000Z"}, {"uuid": "991c88d4-5c8d-4d1f-9c78-535e6f4ace40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30882", "type": "seen", "source": "https://t.me/true_secator/3055", "content": "\u041b\u043e\u0432\u043a\u0438\u0439 \u043f\u0440\u0438\u0435\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043d\u0443\u043b\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 PyPI keep, pyanxdns \u0438 api-res-py, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u0438\u0441\u0442\u0440\u043e\u0438\u043b\u0438 \u0431\u044d\u043a\u0434\u043e\u0440. \u041f\u0440\u0438\u0447\u0435\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0430\u0444\u0435\u0440\u0443 \u0431\u0435\u0437 \u043e\u0441\u043e\u0431\u044b\u0445 \u0443\u0441\u0438\u043b\u0438\u0439, \u0430\u0432\u0442\u043e\u0440\u044b \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441\u0430\u043c\u0438 \u043f\u043e\u043f\u0430\u043b\u0438\u0441\u044c \u0438\u0437-\u0437\u0430 \u0431\u0430\u043d\u0430\u043b\u044c\u043d\u043e\u0439 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0438 \u0432\u00a0setup.py. \n\n\u041b\u0430\u0437\u0435\u0439\u043a\u0430 \u043d\u0430\u0448\u043b\u0430\u0441\u044c \u0432\u043e \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u043c \u0432 \u043a\u043e\u0434 \u043c\u043e\u0434\u0443\u043b\u0435 Python \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u041e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0437\u0430\u043f\u0440\u043e\u0441\u00a0requests \u0431\u044b\u043b \u0438\u0437\u043c\u0435\u043d\u0435\u043d \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043d\u0430 equest (\u0431\u0435\u0437\u00a0s), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e. \u0411\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0432\u043e\u0441\u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438,\u00a0\u043f\u0430\u043a\u0435\u0442 keep \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442\u0441\u044f \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u0431\u043e\u043b\u0435\u0435 8000 \u0440\u0430\u0437\u00a0\u0432 \u043d\u0435\u0434\u0435\u043b\u044e.\n\n\u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0431\u044b\u043b\u0430 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u0430 \u043c\u0430\u0435 GitHub-\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c duxinglin1. \u0412\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0431\u044b\u043b\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u044b: CVE-2022-30877\u00a0(\u0434\u043b\u044f keep \u0432\u0435\u0440\u0441\u0438\u0438 1.2), CVE-2022-30882\u00a0 (\u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u0430 \u0432\u0435\u0440\u0441\u0438\u044f 0.2 \u043f\u0430\u043a\u0435\u0442\u0430 pyanxdns), CVE-2022-31313\u00a0(\u0443\u044f\u0437\u0432\u0438\u043c\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f 0.1 \u043f\u0430\u043a\u0435\u0442\u0430 api-res-py). \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u043f\u0430\u043a\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0431\u044b\u043b \u0443\u0434\u0430\u043b\u0435\u043d PyPI, \u043c\u043d\u043e\u0433\u0438\u0435 \u0437\u0435\u0440\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u0430\u0439\u0442\u044b \u043d\u0435 \u0443\u0434\u0430\u043b\u0438\u043b\u0438 \u044d\u0442\u043e\u0442 \u043f\u0430\u043a\u0435\u0442 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0435\u0433\u043e \u0432\u0441\u0435 \u0435\u0449\u0435 \u043c\u043e\u0436\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c.\n\n\u0421\u0442\u0440\u043e\u043a\u0430 57 \u043a\u043e\u0434\u0430 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u00ab\u0437\u0430\u043f\u0440\u043e\u0441\u0430\u00bb \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 URL-\u0430\u0434\u0440\u0435\u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e check.so \u0432 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u043a\u0435 base64.\u00a0\u0410\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 Intel \u043f\u043e\u00a0\u0443\u0433\u0440\u043e\u0437\u0430\u043c Blackorbird\u00a0\u0442\u0430\u043a\u0436\u0435\u00a0\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u043b\u00a0\u0438 \u0434\u0440\u0443\u0433\u0438\u0435 URL-\u0430\u0434\u0440\u0435\u0441\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 request: http://dexy[.]top/request/check.so \u0438 http://dexy[.]top/x.pyx.\n\nCheck.so \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0442\u0440\u043e\u044f\u043d \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (RAT), \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, x.pyx \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043a\u0440\u0430\u0434\u0435\u0442 \u0444\u0430\u0439\u043b\u044b cookie \u0438 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0441 Chrome, Firefox, Yandex \u0438 Brave, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u044f\u0442 \u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u043e\u0432 \u0438 \u0443\u0447\u0451\u0442\u043e\u043a.\n\n\u041d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435 \u0442\u0440\u044e\u043a \u0441 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 \u043d\u0435 \u043d\u043e\u0432\u044b\u0439: \u0432 2020 \u0433\u043e\u0434\u0443 Tencent Onion\u00a0\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439\u00a0\u0437\u0430\u043f\u0440\u043e\u0441 typosquat, \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0439 \u0432 PyPI, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u0434\u0430\u0432\u0430\u043b \u0441\u0435\u0431\u044f \u0437\u0430 \u043b\u0435\u0433\u0430\u043b\u044c\u043d\u0443\u044e HTTP-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443\u00a0\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u043d\u043e \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u0433\u0440\u0443\u0437\u0438\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u041f\u041e. \n\n\u041f\u043e \u0438\u0442\u043e\u0433\u0443, \u043e\u0448\u0438\u0431\u043a\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b, \u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c - \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0435 \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0435 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0438 \u043f\u0435\u0440\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u0433\u043e \u043a\u043e\u0434\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439, \u043a\u0430\u043a \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044f, \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d \u043d\u0435\u043f\u0440\u0435\u0434\u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u043e \u0435\u0433\u043e \u0436\u0435 \u0430\u0432\u0442\u043e\u0440\u0430\u043c\u0438.", "creation_timestamp": "2022-06-14T14:45:55.000000Z"}, {"uuid": "08d5ee36-ebcf-4fd8-8c4b-96ac63c5d151", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30882", "type": "seen", "source": "https://t.me/cibsecurity/44062", "content": "\u203c CVE-2022-30882 \u203c\n\npyanxdns package in PyPI version 0.2 is vulnerable to code execution backdoor. The impact is: execute arbitrary code (remote). When installing the pyanxdns package of version 0.2, the request package will be installed.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-09T00:32:31.000000Z"}, {"uuid": "68d8fcc3-c0ce-49c7-a555-622fd78544e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30882", "type": "seen", "source": "https://t.me/hacking_Attack/57174", "content": "Black Hat Ethical Hacking\nPyPI package \u2018keep\u2019 mistakenly included a password stealer\n\nPyPI package \u2018keep\u2019 mistakenly included a password stealerPost Views: 54 \nPremium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.\nReading Time: 4 Minutes\nPyPI packages \u2018keep,\u2019 \u2018pyanxdns,\u2019 \u2018api-res-py\u2019 were found to\u00a0be containing\u00a0a\u00a0backdoor due to the presence of malicious \u2018request\u2019 dependency within some\u00a0versions.\nFor example, while most versions of \u2018keep\u2019 project\u00a0use the legitimate Python module requests\u00a0for making HTTP requests, \u2018keep\u2019 v.1.2 contains \u2018request\u2019 (without s) which is\u00a0malware.\n\nBleepingComputer reached out to the authors of each of these packages to understand if this was caused by a\u00a0mere typographical error,\u00a0\u00a0self-sabotage,\u00a0or by maintainer accounts getting hijacked. PyPI package \u2018keep\u2019 uses malicious \u2018request\u2019Some versions of PyPI packages, \u2018keep,\u2019\u00a0\u2018pyanxdns,\u2019 and \u2018api-res-py\u2019 were caught using a malicious dependency,\u00a0\u2018request,\u2019\n\nBack in May, GitHub user duxinglin1\u00a0noticed\u00a0the\u00a0vulnerable versions contained the misspelled\u00a0\u2018request\u2019 dependency, as opposed to the legitimate requests\u00a0library.\n\nAs such, the following CVEs have been assigned this week with regards to the vulnerable versions:\n\n* CVE-2022-30877\u00a0\u2013\u00a0\u2018keep\u2019\u00a0version 1.2 contains the backdoor \u2018request\u2019, contrary to what the advisory implies.\n* CVE-2022-30882\u00a0\u2013 \u2018pyanxdns\u2019 version 0.2 impacted\n* CVE-2022-31313\u00a0\u2013 \u2018api-res-py\u2019 version 0.1 impacted\n\nAlthough \u2018pyanxdns\u2019 and \u2018api-res-py\u2019 might be small scale projects,\u00a0\u00a0the \u2018keep\u2019 package, in particular, gets downloaded over\u00a08,000\u00a0times\u00a0in a week on average\u2014with its version 1.2 using the malicious dependency:\nhttps://www.bleepstatic.com/images/news/u/1164866/2022/jun-2022/pypi-request-keep-backdoor/pypi-keep-page.jpeg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:36.327302Z"}, {"uuid": "f38073ee-be57-42cc-96dd-629fc0e7c901", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30882", "type": "seen", "source": "https://t.me/hacking_Attack/57174", "content": "Black Hat Ethical Hacking\nPyPI package \u2018keep\u2019 mistakenly included a password stealer\n\nPyPI package \u2018keep\u2019 mistakenly included a password stealerPost Views: 54 \nPremium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.\nReading Time: 4 Minutes\nPyPI packages \u2018keep,\u2019 \u2018pyanxdns,\u2019 \u2018api-res-py\u2019 were found to\u00a0be containing\u00a0a\u00a0backdoor due to the presence of malicious \u2018request\u2019 dependency within some\u00a0versions.\nFor example, while most versions of \u2018keep\u2019 project\u00a0use the legitimate Python module requests\u00a0for making HTTP requests, \u2018keep\u2019 v.1.2 contains \u2018request\u2019 (without s) which is\u00a0malware.\n\nBleepingComputer reached out to the authors of each of these packages to understand if this was caused by a\u00a0mere typographical error,\u00a0\u00a0self-sabotage,\u00a0or by maintainer accounts getting hijacked. PyPI package \u2018keep\u2019 uses malicious \u2018request\u2019Some versions of PyPI packages, \u2018keep,\u2019\u00a0\u2018pyanxdns,\u2019 and \u2018api-res-py\u2019 were caught using a malicious dependency,\u00a0\u2018request,\u2019\n\nBack in May, GitHub user duxinglin1\u00a0noticed\u00a0the\u00a0vulnerable versions contained the misspelled\u00a0\u2018request\u2019 dependency, as opposed to the legitimate requests\u00a0library.\n\nAs such, the following CVEs have been assigned this week with regards to the vulnerable versions:\n\n* CVE-2022-30877\u00a0\u2013\u00a0\u2018keep\u2019\u00a0version 1.2 contains the backdoor \u2018request\u2019, contrary to what the advisory implies.\n* CVE-2022-30882\u00a0\u2013 \u2018pyanxdns\u2019 version 0.2 impacted\n* CVE-2022-31313\u00a0\u2013 \u2018api-res-py\u2019 version 0.1 impacted\n\nAlthough \u2018pyanxdns\u2019 and \u2018api-res-py\u2019 might be small scale projects,\u00a0\u00a0the \u2018keep\u2019 package, in particular, gets downloaded over\u00a08,000\u00a0times\u00a0in a week on average\u2014with its version 1.2 using the malicious dependency:\nhttps://www.bleepstatic.com/images/news/u/1164866/2022/jun-2022/pypi-request-keep-backdoor/pypi-keep-page.jpeg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:46.872203Z"}, {"uuid": "40d5565a-f238-4393-9fe0-fd2c515c7f6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30882", "type": "seen", "source": "https://t.me/hacking_Attack/57174", "content": "Black Hat Ethical Hacking\nPyPI package \u2018keep\u2019 mistakenly included a password stealer\n\nPyPI package \u2018keep\u2019 mistakenly included a password stealerPost Views: 54 \nPremium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.\nReading Time: 4 Minutes\nPyPI packages \u2018keep,\u2019 \u2018pyanxdns,\u2019 \u2018api-res-py\u2019 were found to\u00a0be containing\u00a0a\u00a0backdoor due to the presence of malicious \u2018request\u2019 dependency within some\u00a0versions.\nFor example, while most versions of \u2018keep\u2019 project\u00a0use the legitimate Python module requests\u00a0for making HTTP requests, \u2018keep\u2019 v.1.2 contains \u2018request\u2019 (without s) which is\u00a0malware.\n\nBleepingComputer reached out to the authors of each of these packages to understand if this was caused by a\u00a0mere typographical error,\u00a0\u00a0self-sabotage,\u00a0or by maintainer accounts getting hijacked. PyPI package \u2018keep\u2019 uses malicious \u2018request\u2019Some versions of PyPI packages, \u2018keep,\u2019\u00a0\u2018pyanxdns,\u2019 and \u2018api-res-py\u2019 were caught using a malicious dependency,\u00a0\u2018request,\u2019\n\nBack in May, GitHub user duxinglin1\u00a0noticed\u00a0the\u00a0vulnerable versions contained the misspelled\u00a0\u2018request\u2019 dependency, as opposed to the legitimate requests\u00a0library.\n\nAs such, the following CVEs have been assigned this week with regards to the vulnerable versions:\n\n* CVE-2022-30877\u00a0\u2013\u00a0\u2018keep\u2019\u00a0version 1.2 contains the backdoor \u2018request\u2019, contrary to what the advisory implies.\n* CVE-2022-30882\u00a0\u2013 \u2018pyanxdns\u2019 version 0.2 impacted\n* CVE-2022-31313\u00a0\u2013 \u2018api-res-py\u2019 version 0.1 impacted\n\nAlthough \u2018pyanxdns\u2019 and \u2018api-res-py\u2019 might be small scale projects,\u00a0\u00a0the \u2018keep\u2019 package, in particular, gets downloaded over\u00a08,000\u00a0times\u00a0in a week on average\u2014with its version 1.2 using the malicious dependency:\nhttps://www.bleepstatic.com/images/news/u/1164866/2022/jun-2022/pypi-request-keep-backdoor/pypi-keep-page.jpeg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T17:00:05.548837Z"}, {"uuid": "bb74b4de-269e-402e-89ae-8deae56ba272", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30882", "type": "seen", "source": "https://t.me/hacking_Attack/57174", "content": "Black Hat Ethical Hacking\nPyPI package \u2018keep\u2019 mistakenly included a password stealer\n\nPyPI package \u2018keep\u2019 mistakenly included a password stealerPost Views: 54 \nPremium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.\nReading Time: 4 Minutes\nPyPI packages \u2018keep,\u2019 \u2018pyanxdns,\u2019 \u2018api-res-py\u2019 were found to\u00a0be containing\u00a0a\u00a0backdoor due to the presence of malicious \u2018request\u2019 dependency within some\u00a0versions.\nFor example, while most versions of \u2018keep\u2019 project\u00a0use the legitimate Python module requests\u00a0for making HTTP requests, \u2018keep\u2019 v.1.2 contains \u2018request\u2019 (without s) which is\u00a0malware.\n\nBleepingComputer reached out to the authors of each of these packages to understand if this was caused by a\u00a0mere typographical error,\u00a0\u00a0self-sabotage,\u00a0or by maintainer accounts getting hijacked. PyPI package \u2018keep\u2019 uses malicious \u2018request\u2019Some versions of PyPI packages, \u2018keep,\u2019\u00a0\u2018pyanxdns,\u2019 and \u2018api-res-py\u2019 were caught using a malicious dependency,\u00a0\u2018request,\u2019\n\nBack in May, GitHub user duxinglin1\u00a0noticed\u00a0the\u00a0vulnerable versions contained the misspelled\u00a0\u2018request\u2019 dependency, as opposed to the legitimate requests\u00a0library.\n\nAs such, the following CVEs have been assigned this week with regards to the vulnerable versions:\n\n* CVE-2022-30877\u00a0\u2013\u00a0\u2018keep\u2019\u00a0version 1.2 contains the backdoor \u2018request\u2019, contrary to what the advisory implies.\n* CVE-2022-30882\u00a0\u2013 \u2018pyanxdns\u2019 version 0.2 impacted\n* CVE-2022-31313\u00a0\u2013 \u2018api-res-py\u2019 version 0.1 impacted\n\nAlthough \u2018pyanxdns\u2019 and \u2018api-res-py\u2019 might be small scale projects,\u00a0\u00a0the \u2018keep\u2019 package, in particular, gets downloaded over\u00a08,000\u00a0times\u00a0in a week on average\u2014with its version 1.2 using the malicious dependency:\nhttps://www.bleepstatic.com/images/news/u/1164866/2022/jun-2022/pypi-request-keep-backdoor/pypi-keep-page.jpeg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:42.189723Z"}]}