Is there something about Python or PyPI that makes it more attractive for malicious developers to add malware?
Is this also happening for repos for other languages (e.g. CPAN, RubyGems)?
Dozens of malicious PyPI packages discovered targeting developers
11–20 of 334 posts
Re: Dozens of malicious PyPI packages discovered targeting developers
#12W4SP is a python module that harvests passwords from your computer/network?
Re: Dozens of malicious PyPI packages discovered targeting developers
#13Is there something about Python or PyPI that makes it more attractive for malicious developers to add malware? Is this also happening for repos for other languages (e.g. CPAN, RubyGems)?
Python is just far more popular.
RubyGem: https://www.bleepingcomputer.com/news/security/malicious-rub...
Perl CPAN https://news.perlfoundation.org/post/malicious-code-found-in...
Re: Dozens of malicious PyPI packages discovered targeting developers
#14I started to develop only inside VMs, with a full Desktop, IDE, browser etc. inside the virtual machine. There have been to many contaminations of major package repos lately. Only one typo in an import statement up the dependency chain and you’d be compromised.
I've tried the same but the graphics performance was too slow (no GPU acceleration). The current setup is to use a virtual machine but connect to it via VS Code's Remote SSH extension from the host.
Re: Dozens of malicious PyPI packages discovered targeting developers
#15Is there something about Python or PyPI that makes it more attractive for malicious developers to add malware? Is this also happening for repos for other languages (e.g. CPAN, RubyGems)?
Python is just far more popular. RubyGem: https://www.bleepingcomputer.com/news/security/malicious-rub... Perl CPAN https://news.perlfoundation.org/post/malicious-code-found-in...
I think this has more to due with the contexts/industries we typically see Python used in over pure popularity. If popularity was the only factor I'd expect to seeing a lot more news about these problems in Java/PHP ecosystems which are absolutely massive.
Re: Dozens of malicious PyPI packages discovered targeting developers
#16I started to develop only inside VMs, with a full Desktop, IDE, browser etc. inside the virtual machine. There have been to many contaminations of major package repos lately. Only one typo in an import statement up the dependency chain and you’d be compromised.
I've tried the same but the graphics performance was too slow (no GPU acceleration). The current setup is to use a virtual machine but connect to it via VS Code's Remote SSH extension from the host.
I hope you've turned off VS Code's "workspace trust" settings.
Re: Dozens of malicious PyPI packages discovered targeting developers
#17I started to develop only inside VMs, with a full Desktop, IDE, browser etc. inside the virtual machine. There have been to many contaminations of major package repos lately. Only one typo in an import statement up the dependency chain and you’d be compromised.
Then you might be interested in Qubes OS: https://qubes-os.org .
That's why I chose it. A lot of peace of mind there.
Re: Dozens of malicious PyPI packages discovered targeting developers
#18W4SP is a python module that harvests passwords from your computer/network?
That's correct, it's exfiltrating data from the developer machine
Re: Dozens of malicious PyPI packages discovered targeting developers
#19Is there something about Python or PyPI that makes it more attractive for malicious developers to add malware? Is this also happening for repos for other languages (e.g. CPAN, RubyGems)?
For what it's worth, this happens in pretty much all the ecosystems. We have seen similar behavior in NPM, rubygems, and others. PyPI is just really popular.
Re: Dozens of malicious PyPI packages discovered targeting developers
#20I started to develop only inside VMs, with a full Desktop, IDE, browser etc. inside the virtual machine. There have been to many contaminations of major package repos lately. Only one typo in an import statement up the dependency chain and you’d be compromised.
Virtual is part of a solution but not the key: the key is to separate your dev env from your real life/business environment -- including all your personal and professional business data and web accounts that expose your financials and private data. If you log into your email from the virtual machine, you are at risk.
I think that separation is the point of the VM. Do the dev work in the VM, don't give it sensitive info about yourself.