Malicious PyPI package targets Chimera users to steal AWS tokens, CI/CD secrets – Source: www.csoonline.com

A malicious Python package posing as a harmless add-on for the Chimera sandbox environment, an integrated machine learning experimentation and development tool, is helping threat actors steal sensitive corporate credentials.

This poses a direct risk to corporate and cloud infrastructures, enabling attackers to maliciously access and possibly alter or steal large volumes of data through compromised API credentials, Schwake added.

Targeting corporate and cloud infrastructure

The package targets users of the cloud-based, chimera-sandbox environment, in an attempt to cast a wider net and steal high-value corporate-level credentials. Intelligence gained from stolen tokens and logs could help attackers further infiltrate or sabotage infrastructure.

“The package aims to steal credentials and other sensitive information such as JAMF configuration, CI/CD environment variables, and AWS tokens,” JFrog researchers said in a blog post. Additionally, it exfiltrates Pod sandbox environment authentication tokens and git data, Zscaler host configuration, public IP address, and general platform, user, and host information.

Once installed, the package kicks off a sophisticated domain generation algorithm (DGA), choosing from a set of 10 addresses to locate its command-and-control (C2) center. After C2 communication is achieved, it downloads a dynamic, second-stage Python payload tailored to steal environment data.

“This incident underscores the growing sophistication of supply chain attacks, where seemingly trustworthy packages can deliver dangerous malware,” said Mike McGuire, senior security solutions manager at Black Duck. “Unfortunately, attacks like these are likely to increase in frequency, so teams need to take a layered approach to defending themselves.”

Protection needs a multi-layered approach

Experts are treating the chimera-sandbox-extension incident as more than just another malicious package takedown. While JFrog acted quickly—alerting PyPI maintainers, removing the package, and updating its Xray scanner–researchers agree that a one-time fix isn’t enough.

“Within the last five years, attackers have leveraged PyPI and other package managers to exploit developer trust through typosquatting and supply chain attacks,” said Fletcher Davis, senior security research manager and BeyondTrust. “The chimera-sandbox extensions incident underscores that traditional security approaches are insufficient against modern supply chain threats. Supply chain security requires a proactive, multi-layered approach combining technical controls, process improvements, and continuous monitoring rather than relying solely on reactive measures.”

More specifically, Jason Soroko, senior fellow at Sectigo, said banning direct “PiP” and “uv” installs from public indexes can help. “Mirror approved dependencies in an internal repository and enforce hash pinning in lockfiles,” he added. “Scan all incoming packages with static and dynamic analysis to detect DGA calls and credential‑harvesting code observed in chimera‑sandbox‑extensions. Automate removal of outdated or unused dependencies.” Abuse of open-source package managers has surged in recent years, driven by their massive reach and the potential for widespread impact through millions of daily downloads. In recent findings, attackers leveraged the npm package manager to push malicious packages for erasing entire production systems, spying on DevOps machines, and planting stealers and RCE malware.