Devs unknowingly use “malicious” modules snuck into official Python repository
1–10 of 119 posts
Re: Devs unknowingly use “malicious” modules snuck into official Python repository
#2One nice thing about languages like C is that a lot of programmers just avoid dependencies because dealing with them kind of sucks. That's one solution to this problem.
Re: Devs unknowingly use “malicious” modules snuck into official Python repository
#3How do you check if you are affected?
Re: Devs unknowingly use “malicious” modules snuck into official Python repository
#4How do you check if you are affected?
I was wondering the same thing.. and why isn't there a list of package names included in this article?
Re: Devs unknowingly use “malicious” modules snuck into official Python repository
#5How do you check if you are affected?
The list is in the advisory. Check if you have installed any of these:
– acqusition (uploaded 2017-06-03 01:58:01, impersonates acquisition)
– apidev-coop (uploaded 2017-06-03 05:16:08, impersonates apidev-coop_cms)
– bzip (uploaded 2017-06-04 07:08:05, impersonates bz2file)
– crypt (uploaded 2017-06-03 08:03:14, impersonates crypto)
– django-server (uploaded 2017-06-02 08:22:23, impersonates django-server-guardian-api)
– pwd (uploaded 2017-06-02 13:12:33, impersonates pwdhash)
– setup-tools (uploaded 2017-06-02 08:54:44, impersonates setuptools)
– telnet (uploaded 2017-06-02 15:35:05, impersonates telnetsrvlib)
– urlib3 (uploaded 2017-06-02 07:09:29, impersonates urllib3)
– urllib (uploaded 2017-06-02 07:03:37, impersonates urllib3)Re: Devs unknowingly use “malicious” modules snuck into official Python repository
#6How do you check if you are affected?
There are many tools that can scan your dependencies and tell you if anything is off. Here's one for reference (cannot vouch for it though as I have not used it):
https://github.com/jeremylong/DependencyCheck/blob/master/RE...
Re: Devs unknowingly use “malicious” modules snuck into official Python repository
#7FYI: "Malicious software libraries found in PyPI posing as well known libraries"
https://news.ycombinator.com/item?id=15256121
(2 days ago, 465 points, 245 comments)
Re: Devs unknowingly use “malicious” modules snuck into official Python repository
#8How do you check if you are affected?
The list is in the advisory. Check if you have installed any of these: – acqusition (uploaded 2017-06-03 01:58:01, impersonates acquisition) – apidev-coop (uploaded 2017-06-03 05:16:08, impersonates apidev-coop_cms) – bzip (uploaded 2017-06-04 07:08:05, impersonates bz2file) – crypt (uploaded 2017-06-03 08:03:14, impersonates crypto) – django-server (uploaded 2017-06-02 08:22:23, impersonates django-server-guardian-a…
Really close call (I have the correct version of setuptools installed which is what had me worried).
Re: Devs unknowingly use “malicious” modules snuck into official Python repository
#9One nice thing about languages like C is that a lot of programmers just avoid dependencies because dealing with them kind of sucks. That's one solution to this problem.
Haha, I was just about to come say that.
Re: Devs unknowingly use “malicious” modules snuck into official Python repository
#10How do you check if you are affected?
The advisory has a regex, but it's not formatted well for copy-paste (non-ASCII quotes!). Here's a version that works:
pip list –format=legacy | egrep ‘^(acqusition|apidev-coop|bzip|crypt|django-server|pwd|setup-tools|telnet|urlib3|urllib) ‘