Malicious PyPI package with 37,000 downloads steals AWS keys

A malicious PyPI package called 'fabrice' — a typosquat of the popular 'fabric' library — was published since 2021 and downloaded over 37,000 times; it installs OS-specific payloads (Linux shell scripts and Windows VBScript/Python binaries) to maintain persistence and uses boto3 to harvest AWS credentials, exfiltrating them to an attacker-operated server, with recommendations to verify package names and secure AWS IAM and credentials.