Malicious Python Package Mimics Parsimonious Parser to Deliver Malware

Key Takeaways

• A malicious Python package, “parsimonius,” was discovered on the PyPI repository.
• The package employed typosquatting to mimic the legitimate “parsimonious” library, tricking developers into installing malware.
• It installed a Telegram-based backdoor, enabling remote access and exfiltration of sensitive data like .env files and bot authentication tokens.
• Before its removal, the package was downloaded 2,474 times, highlighting the rapid spread of software supply chain attacks.

A deceptive Python package, designed to impersonate the widely used “Parsimonious Parser” library, successfully infiltrated the PyPI repository, exposing thousands of developers to potential compromise before its eventual removal. Researchers from Zscaler’s ThreatLabz team identified the malicious offering and documented their findings in a detailed report.

The rogue package, named “parsimonius,” was meticulously crafted to appear nearly identical to the legitimate library, a popular Python tool for constructing expression grammar parsers. The subtle difference—a single missing letter in the name—was a calculated move to exploit common developer habits and automated dependency resolution systems.

Typosquatting and Version Number Manipulation

This attack leveraged typosquatting, a technique where threat actors register package names that closely resemble trusted ones to trick users. To further enhance its deceptiveness, the malicious package was assigned a version number that appeared newer than the legitimate release. This tactic significantly increased the likelihood of developers installing the incorrect package, particularly those relying on automated tools or failing to meticulously verify package names and versions.

Security analysts at Zscaler ThreatLabz uncovered the package and shared their insights. According to their analysis, the malicious package garnered 2,474 downloads within a few days before it was taken down from the repository. This rapid adoption underscores the critical speed at which software supply chain compromises can propagate across development environments.

Covert Backdoor Deployment

The sophistication of this campaign lay in its dual functionality. On the surface, the malicious package delivered the expected parsing capabilities of the genuine “parsimonious” library, ensuring that developers experienced no immediate suspicious behavior. However, beneath this legitimate facade, a Telegram-based backdoor was silently deployed on every affected system. This backdoor established a covert communication channel, using the Telegram messaging platform for command and control operations and exfiltrating stolen data.

The use of Telegram as a backdoor mechanism is an increasingly prevalent trend among threat actors. The platform’s widespread trust and the reduced likelihood of its traffic being flagged by conventional network monitoring tools make it an attractive option for stealthy data exfiltration and maintaining persistent remote access to compromised systems.

Targeted Data Theft

The attackers specifically targeted sensitive information, including .env files and bot authentication tokens. This focus indicates a deliberate strategy to gain broader infrastructure access. Compromised .env files can expose critical credentials such as database passwords, cloud service access keys, and other secrets, allowing attackers to move laterally within an organization’s systems or connected services.

Similarly, the theft of bot authentication tokens poses a significant risk. With these tokens, attackers can seize control of bots integrated into business workflows, automated pipelines, or customer-facing services. The repercussions of such control can extend far beyond the initially compromised machine, potentially impacting a wide array of interconnected systems and operations.

What You Should Do

• Verify Package Names: Always double-check the exact spelling and source of any package before installation, especially for widely used libraries.
• Implement Dependency Auditing: Utilize tools that can automatically scan for and flag suspicious, newly registered, or typosquatted packages in your dependency tree.
• Rotate Credentials: If a supply chain compromise is suspected, immediately rotate all credentials, API keys, and secrets that could have been exposed, particularly those stored in .env files or associated with bot tokens.
• Limit Sensitive Data: Minimize the amount of sensitive data stored directly within .env files. Consider using secure environment variable management systems or secrets management solutions.
• Monitor Network Traffic: Implement robust network monitoring to detect unusual outbound connections, including those to known Telegram infrastructure, which could indicate C2 activity.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.