Detection of Typosquatted Python Package Installation

This threat brief details the detection of typosquatted Python package installations, a common technique employed by attackers to compromise software supply chains. Attackers create and publish malicious Python packages with names deliberately misspelled or slightly altered to resemble popular legitimate libraries (e.g., reqeusts instead of requests). These malicious packages are uploaded to public repositories like PyPI, where unsuspecting developers might inadvertently install them. The detection leverages Cisco Network Visibility Module (NVM) flow telemetry, monitoring for pip or poetry package manager commands with "install" or "add" flags that make outbound connections to legitimate package repositories (such as pypi.org, pythonhosted.org, python-poetry.org), specifically when the package name matches known or suspected typosquatted identifiers. This analytic was created on 2025-07-01 and last modified on 2026-07-14, highlighting an ongoing risk.

Attack Chain

1. Attacker Creates Malicious Package: Threat actors develop a malicious Python package containing payloads for data exfiltration, system compromise, or other illicit activities.
2. Typosquatting: The attacker names the malicious package with a slight variation of a popular, legitimate Python library (e.g., djanga instead of django, coloramaa instead of colorama).
3. Publication to Public Repository: The typosquatted malicious package is uploaded to public Python package indexes such as PyPI (Python Package Index).
4. Victim Lured to Install: A developer or automated system is tricked, perhaps through social engineering, a typo in a development script, or a compromised upstream dependency, into attempting to install the malicious package.
5. Execution of Installation Command: The victim executes a package manager command, such as pip install <typosquatted_package_name> or poetry add <typosquatted_package_name>.
6. Package Manager Fetches Malicious Code: The package manager initiates an outbound network connection to a public Python package repository to download the package corresponding to the typosquatted name.
7. Malicious Code Execution: Upon download, the malicious package's setup scripts (e.g., setup.py) are automatically executed, leading to the attacker achieving initial code execution, persistence, data exfiltration, or further system compromise on the victim's machine.

Impact

Successful installation of a typosquatted Python package can lead to severe consequences, including full system compromise, remote code execution, sensitive data exfiltration, credential theft, or the establishment of persistent backdoors. Attackers frequently use such methods to gain initial access or escalate privileges within development environments, potentially affecting entire software projects and their downstream users. Multiple malicious typosquatting campaigns have been observed targeting the Python Package Index, indicating a widespread and active threat to developers and organizations utilizing Python. The specific impact depends on the payload within the malicious package, but it consistently results in a breach of system integrity and confidentiality.

Recommendation

• Deploy the provided Sigma rules to your SIEM and augment the CommandLine selections with an up-to-date list of known typosquatted Python package names.
• Ensure Cisco Network Visibility Module (NVM) flow data is being collected and ingested into your SIEM, including process_arguments, dest_hostname, and dest_port for accurate correlation.
• Configure the typo_squatted_python_packages lookup table in your environment, referencing external threat intelligence feeds for new typosquatting campaigns, to enhance the effectiveness of detection.
• Monitor for process creation events related to pip and poetry commands on both Windows and Linux endpoints, especially those involving outbound network connections to package repositories.