<\/p>\n\n\n\n
The Supply Chain Security team at Positive Technologies’ Expert Security Center (PT ESC) has uncovered and neutralized a malicious campaign targeting developers, ML engineers, and those integrating DeepSeek into their projects. The attack was orchestrated through the Python Package Index (PyPI) repository.<\/p>\n\n\n\n
The attacker’s account, created in June 2023, remained inactive until January 29, 2024, when two malicious packages\u2014deepseeek<\/em> and deepseekai<\/em>\u2014were registered. Once installed, these packages deployed console commands that, when executed, stole sensitive user data, including system details and environment variables containing database credentials and access keys. The stolen information was transmitted to the attackers via Pipedream, a widely used developer integration platform acting as their command-and-control (C2) server.<\/p>\n\n\n\n Stanislav Rakovsky, Head of Supply Chain Security at PT ESC, highlighted the growing cyber threats targeting trending technologies: “Cybercriminals are always looking for the next big thing to exploit, and DeepSeek’s popularity made it a prime target. What’s particularly interesting is that the malicious code appears to have been generated using an AI assistant, as indicated by comments within the code itself.”<\/em><\/p>\n\n\n\n The malicious packages were uploaded to PyPI on the evening of January 29. Thanks to PT PyAnalysis, Positive Technologies’ automated detection service, the threat was identified and neutralized within minutes. However, the packages had already been downloaded over 200 times before removal.<\/p>\n\n\n\n Given the rising interest in DeepSeek, this attack could have led to widespread data breaches if left undetected. Positive Technologies urges developers to exercise caution when installing new or unfamiliar packages and to leverage PT PyAnalysis for real-time monitoring of PyPI releases, ensuring robust protection against supply chain attacks.<\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":" The Supply Chain Security team at Positive Technologies’ Expert Security […]<\/p>\n","protected":false},"author":40,"featured_media":90440,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1595,9621],"tags":[],"contributor":[9732],"class_list":["post-90439","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-emerging-technologies","contributor-news-desk"],"featured_image_src":"https:\/\/techxmedia.com\/en\/wp-content\/uploads\/2025\/02\/deep-33.jpg","author_info":{"display_name":"Techx Admin","author_link":"https:\/\/techxmedia.com\/en\/author\/techxadmin\/"},"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t