Dozens of malicious PyPI packages discovered targeting developers
1–10 of 334 posts
Re: Dozens of malicious PyPI packages discovered targeting developers
#2PyPi should warn when the package and developer are new.
Re: Dozens of malicious PyPI packages discovered targeting developers
#3I started to develop only inside VMs, with a full Desktop, IDE, browser etc. inside the virtual machine.
There have been to many contaminations of major package repos lately. Only one typo in an import statement up the dependency chain and you’d be compromised.
Re: Dozens of malicious PyPI packages discovered targeting developers
#4I started to develop only inside VMs, with a full Desktop, IDE, browser etc. inside the virtual machine. There have been to many contaminations of major package repos lately. Only one typo in an import statement up the dependency chain and you’d be compromised.
Then you might be interested in Qubes OS: https://qubes-os.org.
Re: Dozens of malicious PyPI packages discovered targeting developers
#5PyPi should warn when the package and developer are new.
Yeah, an onboarding process build on trust and time-delay would be nice.
Re: Dozens of malicious PyPI packages discovered targeting developers
#6Open/free software is great when a great person writes some code and lets you use it, because they are kind and there's nearly no marginal cost.
But malicious actors can get value from polluting the sharing network, and that costs effort to defend against, which means someone(s) has to pay to secure the network, or be open to attack.
Re: Dozens of malicious PyPI packages discovered targeting developers
#7It's using base64 encoded strings to deliver the initial stage. Can this be avoided/flagged more easily if by adding a scan of statements featuring base64 or import?
Re: Dozens of malicious PyPI packages discovered targeting developers
#8Open/free software is great when a great person writes some code and lets you use it, because they are kind and there's nearly no marginal cost. But malicious actors can get value from polluting the sharing network, and that costs effort to defend against, which means someone(s) has to pay to secure the network, or be open to attack.
That’s not an either or thing. Someone you pay to can also be a malicious actor.
Re: Dozens of malicious PyPI packages discovered targeting developers
#9I started to develop only inside VMs, with a full Desktop, IDE, browser etc. inside the virtual machine. There have been to many contaminations of major package repos lately. Only one typo in an import statement up the dependency chain and you’d be compromised.
Virtual is part of a solution but not the key: the key is to separate your dev env from your real life/business environment -- including all your personal and professional business data and web accounts that expose your financials and private data.
If you log into your email from the virtual machine, you are at risk.
Re: Dozens of malicious PyPI packages discovered targeting developers
#10PyPi should warn when the package and developer are new.
Yeah a time/activity based trust system like thepiratebay uses could be helpful.
Also devs should get into the habit of providing sha256 hashes on offical channels (i.e., github readme) so users can validate (if its possible to validate a pkg before executing malicious code in the python ecosystem, I'm not sure how that'd work).