GitHub Advisoryadvisory · PyPI

GHSA-g86j-hwg9-77q5 SentinelOne impersonated via PyPI packages

HIGH Published 2022-12-27 Modified 2022-12-27 Official page ↗
Ecosystem
PyPI
Packages
SentinelOne, sentinelone-sdk, SentineloneSDK, Sentinelone, SentinelOneSDK
Severity
High
Reviewed
2022-12-27

Affected packages

• PyPI SentinelOne: >= 1.0.0, <= 1.2.1 (no fix yet) • PyPI sentinelone-sdk: >= 6.2.1, <= 6.2.2 (no fix yet) • PyPI SentineloneSDK: 1.0.0 (no fix yet) • PyPI Sentinelone: 1.0.0 (no fix yet) • PyPI SentinelOneSDK: 1.0.0 (no fix yet)

Description

In December 2022, threat actors impersonated SentinelOne by uploading fake software development kits (SDKs) onto PyPI. The SDKs contain fully functional SentinelOne clients, but the packages also contained malicious backdoors that are only executed when called on programmatically, as opposed to during installation. The packages have since been taken down from PyPI.

References