On May 10, 2024, Phylum’s automated risk detection platform alerted us to a suspicious publication on PyPI. The package was called requests-darwin-lite and appeared to be a fork of the ever-popular requests package with a few key differences, most notably the inclusion of a malicious Go binary packed into
It is not steganography. It’s just
cat original.png trojan > malicious.png.See? Hidden in an image, clearly that’s steganography! /s