Over 100 Malicious Packages Target Popular ML PyPi Libraries

A Mend.io analysis found over 100 PyPI typosquatting packages impersonating popular machine-learning libraries (e.g., Pytorch, Matplotlib, Selenium). The malicious packages use an encrypted multi-stage payload (Fernet) to fetch and execute obfuscated scripts that steal credentials and Discord tokens, collect and upload cryptocurrency wallet data, replace Electron app.asar files to inject malicious code into wallets (Exodus, Atomic), attempt persistence via startup scripts, and exfiltrate data to attacker-controlled hosts.