North Korean cybercriminals have been using “poisoned” packages written in the Python programming language to infiltrate victims’ systems and deploy malware, according to a U.S. cybersecurity firm.

Palo Alto Networks’ Unit 42 threat research center reported this week that it observed North Korean threat group Citrine Sleet, which the firm tracks under the name Gleaming Pisces, uploading the malicious remote access trojans (RATs) to PyPi, a popular open-source Python repository.

Run by the Python Software Foundation (PSF), PyPI allows anyone to upload open-source packages meeting basic requirements and guidelines, however, this potentially opens the door