{"id":7178,"date":"2025-02-03T15:50:03","date_gmt":"2025-02-03T21:50:03","guid":{"rendered":"https:\/\/www.darkreading.com\/application-security\/ai-malware-deepseek-packages-pypi"},"modified":"2025-02-03T15:50:03","modified_gmt":"2025-02-03T21:50:03","slug":"ai-malware-dressed-up-as-deepseek-packages-lurk-in-pypi","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/02\/03\/ai-malware-dressed-up-as-deepseek-packages-lurk-in-pypi\/","title":{"rendered":"AI Malware Dressed Up as DeepSeek Packages Lurk in PyPi"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

Researchers have found malicious <\/span>DeepSeek-impersonating<\/a><\/span> packages planted in the Python Package Index (PyPi); the code is actually loaded with infostealers. Experts warn that’s probably not the only platform loaded with fake, malicious DeepSeek packages, and that developers should proceed with care.<\/span><\/p>\n

Researchers with Positive Technologies discovered the malicious packages, labeled “deepseekai” and “deepseeek,” trying to trick developers into thinking they were legit.<\/span><\/p>\n

“The attack targeted developers, machine learning [ML] engineers, and ordinary AI enthusiasts who might be interested in integrating DeepSeek into their systems,” the <\/span>Positive Technologies researchers wrote<\/a><\/span> in an analysis.<\/span><\/p>\n

The account behind the attack, “bvk,” was created in June 2023 and sat dormant until the campaign sprang to life on Jan. 29, according to the report. When executed, the researchers noted both “deepseeek” and “deepseekai” drop infostealers to steal sensitive data, including API keys, database credentials, and permissions.<\/span><\/p>\n

The <\/span>malicious PyPi packages<\/a><\/span> have been deleted, but there’s evidence they were downloaded 36 times using the pip package manager and the bandersnatch mirroring tool, and 186 times using the browser, the researchers reported.<\/span><\/p>\n

“Sometimes API keys aren\u2019t leaked, they\u2019re just plain stolen,” Tim Erlin, vice president of product at Wallarm says. “This incident is a good example of attackers taking advantage of the prevailing news cycle. Anytime you\u2019re doing something popular, whether clicking on a link or installing a PyPi package, it\u2019s best to approach the task with a healthy dose of skepticism.”<\/span><\/p>\n

Related:<\/span>DeepSeek Jailbreak Reveals Its Entire System Prompt<\/a><\/p>\n

That mindset can help developers avoid making similar cybersecurity slip-ups, according to Mike McGuire, senior security solutions manager with Black Duck.<\/span><\/p>\n

“In their eagerness to leverage DeepSeek in their tasks, many developers missed the ‘red flag’ that they were downloading packages from an account with a limited, poor reputation, and had their environment variables and secrets compromised as a result,” McGuire says.<\/span><\/p>\n

Ironically given how advanced DeepSeek’s capabilities are touted to be, the attack itself was a fairly low-tech affair, Michael Lieberman, CTO at Kusari, notes.<\/span><\/p>\n

“<\/span>Typosquatting attacks<\/a><\/span> are popular because they work,” Kusari points out. “It’s easy for a developer to mistype a word or use something with a similar-sounding name and suddenly their application is pulling in malicious code. Popular or trendy technologies are at particular risk since the pool of potential victims is larger.”<\/span><\/p>\n

Related:<\/span>Code-Scanning Tool’s License at Heart of Security Breakup<\/a><\/p>\n

Adversaries Using AI to Write Code Faster Too<\/h2>\n

In a novel twist, the researchers found evidence the threat actors used AI to write the malicious code.<\/span><\/p>\n

“There are clear indications that the compromised code was written with AI assistance, providing a real-world example of AI being used for malicious intent,” Wallarm’s Erlin says.<\/span><\/p>\n

Erlin adds that developers should expect similar malicious packages to be scattered among various platforms.<\/span><\/p>\n

“Developers, with malintent or not, are heavily invested in using AI to be more efficient.” he adds. “AI lets developers write more code, faster. We should expect to see the volume of malicious code expand at the same rate as code in general.”<\/span><\/p>\n

To protect their environments from these threats, Raj Mallempati, CEO of BlueFlag Security, says developers need to implement strong security practices throughout the software development lifecycle (SDLC). That means using software composition analysis (SCA) tools, as well as automated vulnerability scanning, limiting the use of unverified packages in developer environments, and threat intelligence monitoring.<\/span><\/p>\n

“This recent incident underscores the need for developers to specifically protect against threats like OSS typosquatting,” Mallempati explains. “Double checking package names and verifying package sources that come from DeepSeek will be key here. As well, developers should enable dependency scanning tools like Github dependabot to ensure they are not downloading malicious packages.”<\/span><\/p>\n

Related:<\/span>OAuth Flaw Exposed Millions of Airline Users to Account Takeovers<\/a><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Researchers have found malicious DeepSeek-impersonating packages planted in the Python<\/p>\n","protected":false},"author":12,"featured_media":7179,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-7178","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/ai-malware-dressed-up-as-deepseek-packages-lurk-in-pypi-scaled.jpg?fit=2560%2C1440&ssl=1",2560,1440,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/ai-malware-dressed-up-as-deepseek-packages-lurk-in-pypi-scaled.jpg?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/ai-malware-dressed-up-as-deepseek-packages-lurk-in-pypi-scaled.jpg?fit=300%2C169&ssl=1",300,169,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/ai-malware-dressed-up-as-deepseek-packages-lurk-in-pypi-scaled.jpg?fit=640%2C360&ssl=1",640,360,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/ai-malware-dressed-up-as-deepseek-packages-lurk-in-pypi-scaled.jpg?fit=640%2C360&ssl=1",640,360,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/ai-malware-dressed-up-as-deepseek-packages-lurk-in-pypi-scaled.jpg?fit=1536%2C864&ssl=1",1536,864,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/ai-malware-dressed-up-as-deepseek-packages-lurk-in-pypi-scaled.jpg?fit=2048%2C1152&ssl=1",2048,1152,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/ai-malware-dressed-up-as-deepseek-packages-lurk-in-pypi-scaled.jpg?fit=1024%2C576&ssl=1",1024,576,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/ai-malware-dressed-up-as-deepseek-packages-lurk-in-pypi-scaled.jpg?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/ai-malware-dressed-up-as-deepseek-packages-lurk-in-pypi-scaled.jpg?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/ai-malware-dressed-up-as-deepseek-packages-lurk-in-pypi-scaled.jpg?fit=2560%2C1440&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7178","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=7178"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7178\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/7179"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=7178"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=7178"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=7178"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}