Possible Python typosquatting detected

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_200
Category	Dependency Chains
Severity	HIGH

Impact

Typosquatting attacks involve the registration of malicious packages in public registries, using names that closely resemble popular or internal packages used by an organization. The objective is to exploit users' mistakes when typing package names, resulting in the unintentional download of the malicious package. Running malicious packages on developers endpoints or in CI pipelines can lead to credential theft, source code leakage, code tampering and more.

Recommended Solution - Buildtime

Evaluate the event details to determine if the suspected package is malicious. If so, remove the malicious package from project dependency files such as requirements.txt, Pipfile and pyproject.toml.

To ensure your build environment or developers' machines haven’t been infected with a malicious package, perform the necessary steps to investigate for any signs of malicious activity.