FortiGuard Labs Threat Research

Supply Chain Attack Using Identical PyPI Packages, “colorslib”, “httpslib”, and “libhttps”

By Jin Lee | January 14, 2023

The FortiGuard Labs team has discovered a new 0-day attack embedded in three PyPI packages (Python Package Index) called ‘colorslib’, ‘httpslib’, and “libhttps”. They were found on January 10, 2023, by monitoring an open-source ecosystem. The Python packages “colorslib” and “httpslib” were published on January 7, 2023, and “libhttps” was published on January 12, 2023. All three were published by the same author, ‘Lolip0p’, as shown in the official PyPI repository.  ‘Lolip0p’ joined the repository close to the publish date.

Figure 1: Package author information

The author puts the project description that may look legitimate and clean as shown below.

Figure 2: Project description of colorslib
Figure 3: Project description of httpslib
Figure 4: Project description of libhttps

All versions of these packages are malicious.

Figure 5: Release history of colorslib
Figure 6: Release history of httpslib
Figure 7: Release history of libhttps

Interestingly, when we look at the script for these packages, we find they are identical.

Figure 8: from all packages

They try to run a PowerShell with a suspicious URL that needs further analysis:


As shown in the VirusTotal entry below, the download URL includes the following binary exe (SHA 256):


While this download URL has not previously been detected by any other threat researchers, some vendors do flag the downloaded executable file as malicious.

Figure 9: This URL has not been detected by VirusTotal
Figure 10: Vendors that detect the downloaded executable Oxzy.exe


The downloaded executable is called ‘Oxyz.exe’. It drops another executable, ‘update.exe’, that runs in the folder ‘%USER%\AppData\Local\Temp\’

Figure 11: Dropped file update.exe

As shown in the VirusTotal entry below, several vendors flag this binary exe as malicious (SHA 256):


Figure 12: Vendors that detect the dropped executable update.exe


When running ‘update.exe’, it drops a series of files to the folder ‘%USER%\AppData\Local\Temp\onefile_%PID_%TIME%’.

Figure 13: update.exe running
Figure 14: Dropped files

The dropped file, ‘SearchProtocolHost.exe’, is flagged as malicious by several vendors (SHA 256):


Figure 15: Vendors that detect SearchProtocolHost.exe


In this blog, we showed a single author posting separate Python packages that use the same code to launch an attack. The author also positions each package as legitimate and clean by including a convincing project description. However, these packages download and run a malicious binary executable.

Python end users should always perform due diligence before downloading and running any packages, especially from new authors. And as can be seen, publishing more than one package in a short time period is no indication that an author is reliable.


Fortinet Protections

FortiGuard AntiVirus detects the malicious executables identified in this report as

Oxzy.exe: Malicious_Behavior.SB

update.exe: PossibleThreat.PALLASNET.H

SearchProtocolHost.exe: Malicious_Behavior.SB

The FortiGuard AntiVirus service is supported by FortiGateFortiMailFortiClient, and FortiEDR. Customers running current AntiVirus updates are protected.

The FortiGuard Web Filtering Service detects the download URLs cited in this report as Malicious and blocks them.









Malicious URLs



Learn more about Fortinet’s FortiGuard Labs threat research and global intelligence organization and Fortinet’s FortiGuard AI-powered Security Services portfolio. Sign up to receive our threat research blogs.