Malicious Chimera Turns Larcenous on Python Package Index

JFrog researchers discovered a malicious PyPI package, 'chimera-sandbox-extensions', which masqueraded as a Chimera Sandbox add-on and delivered a multistage information-stealing payload that harvested credentials, JAMF receipts, CI/CD and AWS tokens, host and git configuration data. The package used a domain-generation algorithm for resilient C2, authenticated to download a second-stage Python payload, and appears tailored to infiltrate development and cloud environments to enable further supply-chain or CI/CD compromise; the package has been identified and disrupted.