Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dozens of malicious PyPI packages discovered targeting developers

blog.phylum.io

Post reply on HN
Print view View original

111–120 of 334 posts

Re: Dozens of malicious PyPI packages discovered targeting developers

#111

Post by WalterBright »

rnk wrote: post #96
iudqnolq wrote: post #91

Earlier quoted context omitted.

All else equal I'd agree. But I'm perplexed why people spend a lot of effort on what seems to me like a purely philosophical benefit.

It's just address part of the problem, which of course is why it seems somewhat pointless. I need to: 1. Install packages/deps/libraries etc safely 2. Run code that includes those libraries that limits their capabilities centrally.

> It's just address part of the problem, which of course is why it seems somewhat pointless

I cut my teeth in the aviation industry, where the idea is to address every part of the problem. No one part will fix everything. Every accident is a combination of multiple failures.

Re: Dozens of malicious PyPI packages discovered targeting developers

#112

Post by ylk »

coffeeblack wrote: post #107
lupire wrote: post #9

Earlier quoted context omitted.

Virtual is part of a solution but not the key: the key is to separate your dev env from your real life/business environment -- including all your personal and professional business data and web accounts that expose your financials and private data. If you log into your email from the virtual machine, you are at risk.

The only place I log into from the VM is Github, protected by 2FA in case any malware gets my password.

The malware will just take the session cookie. Some actions still require 2FA approval, but it’s not many, iirc.

Re: Dozens of malicious PyPI packages discovered targeting developers

#113

Post by odiroot »

rrwo wrote: post #11

Is there something about Python or PyPI that makes it more attractive for malicious developers to add malware? Is this also happening for repos for other languages (e.g. CPAN, RubyGems)?

Yes, it's very very popular. And getting more popular every year.

Re: Dozens of malicious PyPI packages discovered targeting developers

#114

Post by comboy »

louislang wrote: post #28
coffeeblack wrote: post #3

I started to develop only inside VMs, with a full Desktop, IDE, browser etc. inside the virtual machine. There have been to many contaminations of major package repos lately. Only one typo in an import statement up the dependency chain and you’d be compromised.

Full disclosure, I am a co-founder at Phylum. We are actively working on a solution that will fully sandbox package installations for npm, yarn, poetry and others. It's rolled up as part of our core CLI [1], but is totally open source [2]: [1] https://github.com/phylum-dev/cli [2] https://github.com/phylum-dev/birdcage

Why is there so much discussion about sandboxing? Why wouldn't I put some malicious code in the package itself limiting myself to installation only?

Re: Dozens of malicious PyPI packages discovered targeting developers

#115

Post by jorvi »

RockRobotRock wrote: post #44
louislang wrote: post #34

Earlier quoted context omitted.

They are trying. The level of effort to release these things is so low, the effort required to catch it and remove it at scale is much harder, unfortunately.

Are they? I know I'm biased because this affected me and I'm still mad about it, but I just don't buy it. I contacted them, showing the plainly obvious malicious account that was distributing malware. Two months later, they send me a generic message saying that they've "taken appropriate action", but the account and their payload was STILL THERE, they hadn't done anything. The attacker was rapidly changing their user…

I don't know what their standard for 'malicious' is, but they nuked Popcorn Time and Butter (the technological core without the actual piratey bits) from orbit until there was a huge amount of backlash.

Re: Dozens of malicious PyPI packages discovered targeting developers

#116

Post by iudqnolq »

mlyle wrote: post #100
iudqnolq wrote: post #84

Earlier quoted context omitted.

So you never run tests on your dev machine or CI/CD, and never run your code to manually test? I'm not experienced but I thought it was normal to have some way to try out what you've written on your dev machine. Is everyone else stepping through code in their head only, and their code is run for the first time when it's deployed to production?

Your dev machine getting pwned is bad, but your CI server getting screwed up is worse. This way you don't need to sandbox the compiler, and it can freely use system resources and access source trees. You only need to sandbox the execution. (As some people point out in this thread, editors are starting to use compilers to get overall meta-information, too-- if you can't even -view the code- to tell if it's malicious w…

> This way you don't need to sandbox the compiler, and it can freely use system resources and access source trees. You only need to sandbox the execution.

If this is now only helping CI and not dev machines I don't see why it's worth the effort. Wouldn't it be much simpler and more reliable to just sandbox compilation of anything in your CI?

> if you can't even -view the code- to tell if it's malicious without getting exploited, that's bad

I guess? I can't think of a single time in my life where this would have practically helped me.

I skim dependencies on GitHub for obvious red flags and then trust them. I assume places with the resources to do actual in-depth review can disable advanced analysis in their IDEs for that.

Re: Dozens of malicious PyPI packages discovered targeting developers

#117

Post by roflyear »

Once a buddy and I reverse engineered some JS on a site that did the same thing - sent you down one rabbit hole, more obfuscated code, etc.. etc.. we eventually got to the end of it and discovered a comment:

// help my name is ###

// i am being held at #### (address in china)

// please contact my family ###

(this was in chinese, we had to translate it)

Scary!

Re: Dozens of malicious PyPI packages discovered targeting developers

#118

Post by ashishbijlani »

coffeeblack wrote: post #3

I started to develop only inside VMs, with a full Desktop, IDE, browser etc. inside the virtual machine. There have been to many contaminations of major package repos lately. Only one typo in an import statement up the dependency chain and you’d be compromised.

Packj sandbox [1] offers "safe installation" of PyPI/NPM/Rubygems packages.

1. https://github.com/ossillate-inc/packj/blob/main/packj/sandb...

It DOES NOT require a VM/Container; uses strace. It shows you a preview of file system changes that installation will make and can also block arbitrary network communication during installation (uses an allow-list).

Disclaimer: I've been building Packj for over a year now.

Re: Dozens of malicious PyPI packages discovered targeting developers

#120

Post by zepearl »

> Upon first glance, nothing seems out of the ordinary here. However, if you widen up your code editor window (or just turn on word wrapping) you’ll see the __import__ way off in right field. For those counting at home, it was offset by 318 spaces

Haha, simple & effective...

Post reply on HN