My team discovered today an attack on the Python ecosystem with multi-stage persistent malware

We instantly started researching and saw the PyPi user account devfather777 published a dozen malicious Typosquatting packages under the names of popular projects with slight permutation.

All malicious packages contain code executed upon installation and downloads custom made C++ malware hosted on the GitHub repository jagermager999/8746465cdg78cdsxasy8a with interesting capabilities

Findings were reported to the security teams of PyPi and GitHub