45K+ Users Victimized By Malicious PyPI Packages

CRIL investigated a large-scale malicious PyPI campaign where adversaries uploaded over 160 malicious Python packages (including intentionally misspelled names like 'reaquests') to distribute info-stealers and downloaders; the report documents multiple malware families (Creal, W4SP, Hazard Token Grabber, TIKCOCK), obfuscation techniques, evidence of active downloads (~45k total, some packages with hundreds to thousands of installs), and provides extensive IOCs (file hashes, package names) and mitigation recommendations.