A highly advanced cyber attack targeting the software supply chain utilized the Python Package Index (PyPI) to distribute malware through Google’s SMTP servers, which were used as a command-and-control channel.
The attack involved seven harmful packages—Coffin-Codes-Pro, Coffin-Codes-NET2, Coffin-Codes-NET, Coffin-Codes-2022, Coffin2022, Coffin-Grave, and cfc-bsb—that together gained over 55,000 downloads before being removed from the platform.
Advanced Tunneling Mechanism
These malicious packages exploit Gmail’s SMTP infrastructure by connecting to its servers using pre-programmed credentials. This creates a secure two-way tunnel through which attackers can remotely run commands and steal sensitive data. The approach is particularly dangerous as SMTP traffic is often seen as harmless by most security systems, including firewalls and endpoint detection tools.
The main package, Coffin-Codes-Pro, demonstrates this attack strategy in action.
Once the initial connection is made, the malware sets up a WebSocket link, which acts as the communication bridge for command and control operations.
Based on the release timeline of the packages on PyPI, the attacker has been refining this exploit over a span of at least three years.
The earliest package, cfc-bsb, was published in March 2021. Although it lacked the ability to exfiltrate emails, it introduced suspicious WebSocket-based HTTP tunneling, similar to the Ngrok method.
Subsequent versions of the attack enhanced this technique, consistently leveraging Gmail’s SMTP server on port 465 while changing only the account credentials for authentication.
The malicious packages consistently communicated with the same email address: blockchain.bitcoins2020@gmail.com.
These packages present considerable risks, enabling attackers to:
- Gain access to internal dashboards, APIs, and admin panels.
- Execute shell commands and transfer files.
- Steal sensitive information, including credentials.
- Maintain a foothold for further exploitation within the network.
As noted in Socket’s report shared with Cyber Security News, “Previously, threat actors used this tactic to exfiltrate private keys associated with Solana.”
The inclusion of the word “blockchain” in the attack communications hints at the possibility of cryptocurrency theft being a key motivation.
Experts in cybersecurity suggest the following defenses:
- Monitor for unusual outgoing traffic, particularly SMTP-based communication.
- Validate the authenticity of packages by reviewing download statistics and publisher history.
- Perform regular audits of dependencies.
- Enforce strict access controls on sensitive systems.
- Use isolated environments for testing external code.
These findings emphasize a rising trend in supply chain attacks that exploit package repositories.
The Socket GitHub app, CLI, and browser extension offer valuable protection by scanning for malicious or impersonated packages before they are integrated into projects.
While the seven malicious packages have been removed from PyPI, this technique remains a persistent threat, aligning with the MITRE ATT&CK technique T1102.002 (Web Service: Bidirectional Communication).
