Malicious code in xxlsxwriter (PyPI)

An attacker distributed malicious versions of the xxlsxwriter package via PyPI, part of a broader campaign involving 900+ compromised packages. The malicious code installed browser extensions on affected systems with the capability to intercept and manipulate clipboard data and replace cryptocurrency wallet addresses, enabling theft of cryptocurrency transactions.\n\nThe attack was identified and documented by Checkmarx, with credit to the OpenSSF's malicious-packages repository. The incident represents a significant supply chain compromise targeting Python developers and end users who installed the affected package versions.\n\nThis incident demonstrates the risk of typosquatting and package repository compromise, where attackers can distribute malicious code to a large number of users through legitimate-appearing package names.