Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

semgrep.dev

Post reply on HN
Print view View original

101–110 of 196 posts

Re: Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

#101

Post by nulltrace »

nrengan wrote: post #61

Most of my pip installs come from Claude Code suggesting them now and me just hitting enter. Model was trained months ago, so it has no clue what got compromised this week. We built the worst possible filter for "is this package safe right now".

Stale training data is part of it. But even a current model can't tell what setup.py is going to run on your box. Nothing actually inspects the package before it executes. You'd want something that pulls the metadata and checks what hooks are in there before anything runs.

Re: Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

#102

Post by ashishbijlani »

nulltrace wrote: post #101
nrengan wrote: post #61

Most of my pip installs come from Claude Code suggesting them now and me just hitting enter. Model was trained months ago, so it has no clue what got compromised this week. We built the worst possible filter for "is this package safe right now".

Stale training data is part of it. But even a current model can't tell what setup.py is going to run on your box. Nothing actually inspects the package before it executes. You'd want something that pulls the metadata and checks what hooks are in there before anything runs.

Built Packj [1] to do exactly this.

1. Packj (https://github.com/ossillate-inc/packj) detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect bad actors (e.g., typo squatting).

Re: Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

#103

Post by throwatdem12311 »

nrengan wrote: post #61

Most of my pip installs come from Claude Code suggesting them now and me just hitting enter. Model was trained months ago, so it has no clue what got compromised this week. We built the worst possible filter for "is this package safe right now".

Stop blaming the LLM for your laziness and lack of due diligence.

Re: Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

#105

Post by fennecbutt »

eddythompson80 wrote: post #39
JohnMakin wrote: post #33

Earlier quoted context omitted.

People are ramming tons of code into places without ever looking at it, it would follow that supply chain attacks would increase thusly.

Yeah, and ultimately no body cares. Everyone assumes it’s just some process miss, and we need to add another step to the process and move on. Fuck ups that would have killed the credibility of projects 10 years ago are now treated as “eeh what are you gonna do. Sometimes you ship malware. Will look into it”

It's not that nobody cares. It's just that nobody who does care has the money or the power to change it.

Business school. Ahaha.

Re: Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

#106

Post by fjdjshsh »

eddythompson80 wrote: post #39
JohnMakin wrote: post #33

Earlier quoted context omitted.

People are ramming tons of code into places without ever looking at it, it would follow that supply chain attacks would increase thusly.

Yeah, and ultimately no body cares. Everyone assumes it’s just some process miss, and we need to add another step to the process and move on. Fuck ups that would have killed the credibility of projects 10 years ago are now treated as “eeh what are you gonna do. Sometimes you ship malware. Will look into it”

Are you talking about open source or commercial products? I can't speak for the pytorch lighting case, but I wouldn't be surprised if the maintainers didn't get any $ from it. They would be sad if the credibility of the package suffers, but ultimately it wouldn't make a big difference to them

Re: Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

#107

Post by jrumbut »

crabbone wrote: post #64
wlkr wrote: post #32

This might just be the frequency illusion at play, but there seem to have been a number of high-profile supply chain attacks of late in major packages. There are several articles on the first few pages of HN right now with different cases. Looking back ten years to `left-pad`, are there more successful attacks now than ever? I would suspect so, and surely the value of a successful attack has also increased, so are we…

> Looking back ten years to `left-pad`, are there more successful attacks now than ever? I can't vouch for the number of attacks, but, and since we are talking about Python, nothing substantially changed since the time of `left-pad`. The same bad things that enabled supply chain attacks in Python ten years ago are in place today. However, it looks like there are more projects and they are more interconnected than bef…

As scary as it is right now, it warms your heart a little bit that this system existed for 30 years and is only now reaching a crisis point.

I ran an open source project with tens of thousands of downloads (presumably all either developer machines or webservers, so even a small number is valuable) and never received a malicious pull request, offer of a bribe to install malware, or a phishing attempt with enough effort to even catch my attention.

What it says to me is that there weren't a lot of people working on the crime side of this. It's like dropping your wallet in a bar bathroom and coming back to find it still there.

Re: Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

#108

Post by sieabahlpark »

wlkr wrote: post #32

This might just be the frequency illusion at play, but there seem to have been a number of high-profile supply chain attacks of late in major packages. There are several articles on the first few pages of HN right now with different cases. Looking back ten years to `left-pad`, are there more successful attacks now than ever? I would suspect so, and surely the value of a successful attack has also increased, so are we…

[dead]

Re: Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

#109

Post by sieabahlpark »

lacunary wrote: post #69
OtherShrezzing wrote: post #52

Earlier quoted context omitted.

I think in the relatively near future we’re going to start seeing sophisticated supply chain attacks into language model training data. It should be feasible to design vulnerabilities which look benign individually in training data, but when composed together in the agent plane & executed in a chain introduce an exploit. There’s nothing technical really stopping that from existing right now. It’s just that nobody has…

The develop-test-refine feedback loop for this kind of attack is so long (or expensive) that it seems likely to limit its real world use. Poison training data, wait months? a year? for the model to come out, see how well it worked, refine... or do you see a faster way to iterate?

[dead]

Re: Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

#110

Post by pxc »

crabbone wrote: post #64
wlkr wrote: post #32

This might just be the frequency illusion at play, but there seem to have been a number of high-profile supply chain attacks of late in major packages. There are several articles on the first few pages of HN right now with different cases. Looking back ten years to `left-pad`, are there more successful attacks now than ever? I would suspect so, and surely the value of a successful attack has also increased, so are we…

> Looking back ten years to `left-pad`, are there more successful attacks now than ever? I can't vouch for the number of attacks, but, and since we are talking about Python, nothing substantially changed since the time of `left-pad`. The same bad things that enabled supply chain attacks in Python ten years ago are in place today. However, it looks like there are more projects and they are more interconnected than bef…

> It's not just common, it's almost universal to run `pip install` on production machines as a means of deploying a Python program.

Maybe a Python culture problem; maybe a hallmark of Python's status as an "easy to hire for", manager-friendly, least common denominator blub language; maybe a risk that stems from the conveniences of interpreter languages... but this is such a shame in this day and age.

It's seriously not difficult to do better. And if this is what you're doing, you're also missing out on reproducible environments both in dev and in prod. At least autogenerate a Nix package! You still don't need to publish any artifacts, but you can at least have the thing build in a sandbox or yeet the whole closure over SSH.

It's also not that hard to get a Docker image out of a Python project.

You only need one platform-minded person on the whole development team to make this happen.

What is going on???

Post reply on HN