Malicious Package Affecting eoerbisjxqyv package, versions [0,]

eoerbisjxqyv is a malicious package.

This instance of the eoerbisjxqyv package contains malware and attempts to compromise users by adopting dependency confusion techniques. A dependency confusion attack is a type of supply chain attack where malicious software is inserted into the development process by replacing a legitimate software package with a malicious one.

Note: Users are exposed if they've installed the eoerbisjxqyv package from public repositories. Installations of this package from private repositories or CDNs are likely safe to use.

This package is part of an attack campaign targeting the software supply chain, with evidence of successful exploitation of multiple victims. The threat actors used multiple TTPs in this attack, including account takeover via stolen browser cookies, contributing malicious code with verified commits, setting up a custom Python mirror, and publishing malicious packages to the PyPi registry.

These spoofed packages have no relation to the company or project they are attempting to spoof, and are not published by them or associated with them in any way. Out of an abundance of caution, Snyk will mark any occurrence of the package as malicious, regardless of download source. Only the user can determine with certainty whether it is the intended package and can be safely ignored.

• Checkmarx Blog