Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
In March 2024, attackers used a compromised GitHub identity and a lookalike Python package host to direct developers toward a malicious Colorama clone. The evidence describes an attack on developer dependencies and accounts—not a compromise of the official Colorama project—and the payload was designed to steal credentials and session data.
How the attack worked
The campaign combined two kinds of trust abuse: a hijacked GitHub account and a typosquatted download host. The fake host, files.pypihosted.org, differed from the legitimate Python package artifact host, files.pythonhosted.org, by a small but significant part of its name. A familiar package name or filename therefore did not establish that the downloaded code was official.
- Build apparent credibility. Attackers created repositories and used a compromised, reputable GitHub identity to star them and make a malicious commit. A Top.gg contributor’s account was compromised on March 4, 2024.
- Redirect a dependency. The commit added instructions in the
top-gg/python-sdkrepository to download Colorama from the lookalike host. - Disguise the package. The counterfeit code was made to resemble the real package. Checkmarx reported that large blocks of whitespace pushed malicious code out of view during a casual review.
- Run additional code. Importing the package launched further Python code, retrieved additional components and established persistence through the Windows Registry.
- Collect and send data. The malware targeted credentials, tokens and local files, then sent collected information to attacker-controlled infrastructure.
Checkmarx also reported that yocolor version 0.4.6 was published on PyPI on March 5, 2024, as a delivery mechanism in the campaign. That detail does not mean every installation of yocolor, or every Colorama installation, was affected.
When the incident unfolded
| Date | Reported event |
|---|---|
| November 2022 | Checkmarx’s campaign timeline lists earlier malicious PyPI packages associated with the activity. |
| February 1, 2024 | The attacker registered pypihosted.org, enabling the lookalike download host. |
| March 4, 2024 | A Top.gg contributor’s GitHub account was compromised and used to commit malicious code. |
| March 5, 2024 | yocolor version 0.4.6 was published on PyPI as a campaign delivery mechanism. |
| March 25, 2024 | Checkmarx published its technical report; SecurityWeek reported on the incident the same day. |
What the malware targeted
Checkmarx described a multi-stage infostealer rather than a simple package prank. Its reported targets included browser data, cryptocurrency wallets, Discord and other session tokens, Telegram and Instagram data, and local files. The documented Windows Registry persistence means removing the package alone may not remove every component or undo stolen-session exposure.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
#1 Best Overall
Elebase USB to USB C Adapter for iPhone 18 Pro Max,USBC Car Charger Adapter
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Python developer Mohammed Dief described noticing repeated Colorama-related command-line errors before realizing his machine had been compromised. His account is an individual report, not a measure of how many developers were infected.
What is known about the impact
Checkmarx reported multiple infected developers and said the Top.gg community had more than 170,000 members. That figure describes community size; it is not a count of confirmed infections or victims. SecurityWeek reported that Colorama had more than 150 million monthly downloads, a measure of the package’s scale rather than the number of affected downloads.
Rank #2
Anker USB-C Hub, 5-in-1 USB Hub for Laptops, 4K HDMI Multiport Adapter
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
The reported attack used a malicious clone and a compromised contributor identity. The available incident account does not establish that Colorama’s official maintainers or the official Colorama project were compromised. Nor do the reported community and download figures establish how many people installed the malicious code.
Quick Recap
Bestseller No. 5
Best Value
Anker USB C Hub, 5-in-1 USBC to HDMI Splitter with 4K Display
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Rank #4
Sale
UGREEN USB to USB C Adapter Combo 4-Pack, 10Gbps USB C Converter Space Gray
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Rank #3
Sale
Anker USB C Hub, 7in1 Multi-Port USB Adapter, 4K@60Hz USBC to HDMI Splitter
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
How to check whether a dependency or mirror is suspicious
- Compare hostnames character by character. Check every package URL against the expected official host; do not rely on a familiar package name, filename or HTTPS lock icon.
- Review dependency instructions. Inspect
requirements.txt, lockfiles, setup scripts, CI configuration and shell history for direct URLs, unexpected package indexes or references to unfamiliar mirrors. - Verify what was installed. Compare the package version, source URL and hash against trusted project records or an internally approved artifact. A version number alone does not prove provenance.
- Examine code and behavior. Look for unusual import-time network activity, subprocess launches, persistence changes, obfuscated code or large blank regions that can conceal content. Treat these as investigation leads, not proof by themselves.
- Assess identity signals cautiously. A verified-looking GitHub identity, established account history, repository stars or a familiar project association can be useful context, but none proves a particular commit is safe.
What to do if you installed the fake package
- Isolate the suspected device. Disconnect it from networks where practical to limit further communication, and preserve relevant logs and files if an incident investigation may be needed.
- Use a clean device to revoke access. Revoke GitHub sessions and tokens, along with relevant cloud and application sessions. Stolen session cookies can allow access without the attacker knowing the account password.
- Rotate exposed secrets. From a clean device, change passwords and replace API keys or other credentials that may have been present on the machine. Prioritize accounts and keys used on the affected host.
- Inspect and remediate the endpoint. Check for Windows Registry persistence and suspicious processes or files; scan the device with trusted endpoint-security tools. Review browser, cryptocurrency-wallet and messaging sessions for unauthorized access.
- Rebuild from trusted sources. Remove the suspect dependency path, restore the project from a known-good source, and reinstall dependencies only from verified artifacts. Do not return the device to normal use until remediation is complete.
- Check connected build systems. If the affected machine had access to CI, cloud accounts or deployment credentials, investigate those systems and rotate any secrets it could reach.
How teams can reduce the risk
- Enforce dependency and mirror policy. Restrict installs to approved package indexes and repositories; flag or block unapproved direct URLs.
- Pin dependencies and verify hashes where practical. Version pins reduce unintended changes, while hashes help verify that an artifact matches an expected file. Neither makes an untrusted source safe by itself.
- Use provenance and composition controls. Package provenance checks, artifact signing and software-composition analysis can help establish where dependencies came from and identify risky components.
- Monitor install- and import-time behavior. Detection that observes network access, process launches and persistence changes can catch behaviors that static dependency review may miss.
- Protect developer identities and sessions. Use phishing-resistant multifactor authentication, short session lifetimes where available, and regular token review. Treat session cookies as credentials and investigate unexpected repository changes.
- Cover both laptops and CI. Apply dependency policy and monitoring to developer workstations as well as build systems; a clean CI pipeline does not rule out compromise of a developer’s machine or account.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
