{"id":3579,"date":"2025-06-17T12:34:49","date_gmt":"2025-06-17T12:34:49","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=3579"},"modified":"2025-06-17T12:34:49","modified_gmt":"2025-06-17T12:34:49","slug":"malicious-pypi-package-targets-chimera-users-to-steal-aws-tokens-ci-cd-secrets","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=3579","title":{"rendered":"Malicious PyPI package targets Chimera users to steal AWS tokens, CI\/CD secrets"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

A malicious Python package posing as a harmless add-on for the Chimera sandbox environment, an integrated machine learning experimentation and development tool, is helping threat actors steal sensitive corporate credentials.<\/p>\n

According to new research findings from software supply chain and DevOps company JFrog, the package \u201cchimera-sandbox-extensions\u201d, recently uploaded to the popular PyPI repository, contains a stealthy, multi-stage info-stealer.<\/p>\n

\u201cThe detection of harmful packages, such as chimera-sandbox extensions, on PyPI highlights the significant and widespread risk posed by software supply chain attacks,\u201d said Eric Schwake, director of Cybersecurity Strategy at Salt Security. \u201cThe primary threat lies in its ability to collect sensitive developer-related data, including credentials, configuration files, and especially AWS tokens and CI\/CD environment variables.\u201d<\/p>\n

This poses a direct risk to corporate and cloud infrastructures, enabling attackers to maliciously access and possibly alter or steal large volumes of data through compromised API credentials, Schwake added.<\/p>\n

<\/a>Targeting corporate and cloud infrastructure<\/h2>\n

The package targets users of the cloud-based, chimera-sandbox environment, in an attempt to cast a wider net and steal high-value corporate-level credentials. Intelligence gained from stolen tokens and logs could help attackers further infiltrate or sabotage infrastructure.<\/p>\n

\u201cThe package aims to steal credentials and other sensitive information such as JAMF configuration, CI\/CD environment variables, and AWS tokens,\u201d JFrog researchers said in a blog post<\/a>. Additionally, it exfiltrates Pod sandbox environment authentication tokens and git data, Zscaler host configuration, public IP address, and general platform, user, and host information.<\/p>\n

Once installed, the package kicks off a sophisticated domain generation algorithm (DGA), choosing from a set of 10 addresses to locate its command-and-control (C2) center. After C2 communication is achieved, it downloads a dynamic, second-stage Python payload tailored to steal environment data.<\/p>\n

\u201cThis incident underscores the growing sophistication of supply chain attacks, where seemingly trustworthy packages can deliver dangerous malware,\u201d said Mike McGuire, senior security solutions manager at Black Duck. \u201cUnfortunately, attacks like these are likely to increase in frequency, so teams need to take a layered approach to defending themselves.\u201d<\/p>\n

Protection needs a multi-layered approach<\/h2>\n

Experts are treating the chimera-sandbox-extension incident as more than just another malicious package takedown. While JFrog acted quickly\u2014alerting PyPI maintainers, removing the package, and updating its Xray scanner\u2013researchers agree that a one-time fix isn\u2019t enough.<\/p>\n

\u201cWithin the last five years, attackers have leveraged PyPI and other package managers to exploit developer trust through typosquatting and supply chain attacks,\u201d said Fletcher Davis, senior security research manager and BeyondTrust. \u201cThe chimera-sandbox extensions incident underscores that traditional security approaches are insufficient against modern supply chain threats. Supply chain security requires a proactive, multi-layered approach combining technical controls, process improvements, and continuous monitoring rather than relying solely on reactive measures.\u201d<\/p>\n

More specifically, Jason Soroko, senior fellow at Sectigo, said banning direct \u201cPiP\u201d and \u201cuv\u201d installs from public indexes can help. \u201cMirror approved dependencies in an internal repository and enforce hash pinning in lockfiles,\u201d he added. \u201cScan all incoming packages with static and dynamic analysis to detect DGA calls and credential\u2011harvesting code observed in chimera\u2011sandbox\u2011extensions. Automate removal of outdated or unused dependencies.\u201d Abuse of open-source package managers has surged in recent years, driven by their massive reach and the potential for widespread impact through millions of daily downloads. In recent findings, attackers leveraged the npm package manager to push malicious packages for erasing entire production systems<\/a>, spying on DevOps machines<\/a>, and planting stealers and RCE malware<\/a>.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

A malicious Python package posing as a harmless add-on for the Chimera sandbox environment, an integrated machine learning experimentation and development tool, is helping threat actors steal sensitive corporate credentials. According to new research findings from software supply chain and DevOps company JFrog, the package \u201cchimera-sandbox-extensions\u201d, recently uploaded to the popular PyPI repository, contains a […]<\/p>\n","protected":false},"author":0,"featured_media":3580,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-3579","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/3579"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3579"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/3579\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/3580"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3579"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3579"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3579"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}