Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telnyx package compromised on PyPI

telnyx.com

Post reply on HN
Print view View original

101–110 of 153 posts

Re: Telnyx package compromised on PyPI

#101

Post by dist-epoch »

ashishb wrote: post #100
mil22 wrote: post #23

For those using uv , you can at least partially protect yourself against such attacks by adding this to your pyproject.toml : [tool.uv] exclude-newer = "7 days" or this to your ~/.config/uv/uv.toml : exclude-newer = "7 days" This will prevent uv picking up any package version released within the last 7 days, hopefully allowing enough time for the community to detect any malware and yank the package version before you…

Rather than being hopeful why not start running 'uv' inside sandbox? Why does your python package (cli/Web server/library) need full access to your full disk at the time of execution?

You're doing all of your software development inside containers, all the time?

That is very inconvenient.

Re: Telnyx package compromised on PyPI

#102

Post by dist-epoch »

mulmen wrote: post #96
mil22 wrote: post #23

For those using uv , you can at least partially protect yourself against such attacks by adding this to your pyproject.toml : [tool.uv] exclude-newer = "7 days" or this to your ~/.config/uv/uv.toml : exclude-newer = "7 days" This will prevent uv picking up any package version released within the last 7 days, hopefully allowing enough time for the community to detect any malware and yank the package version before you…

Does this also delay delivery of security fixes? Is there an override mechanism for a log4j type event?

It delays everything. You can manually override some packages, but the community can't push through it.

Re: Telnyx package compromised on PyPI

#103

Post by dist-epoch »

bombcar wrote: post #56
__mharrison__ wrote: post #52

Earlier quoted context omitted.

Love it! Let those pip users find the compromised packages for us uv users.

Until everyone waits 7 days to install everything so the compromise is discovered on the 8th day. End result will be everyone runs COBOL only.

I'm already ahead of you. I'm using `exclude-newer = "8 days"`

Re: Telnyx package compromised on PyPI

#104

Post by dist-epoch »

zahlman wrote: post #84

> If the version shown is 4.87.1 or 4.87.2, treat the environment as compromised. More generally speaking one would have to treat the computer/container/VM as compromised. User-level malware still sucks. We've seen just the other day that Python code can run at startup time with .pth files (and probably many other ways). With a source distribution, it can run at install time, too (see e.g. https://zahlman.github.io/p…

Nice thing about VMs is that it's easy to have a daily snapshot, and roll it back to before compromise event.

Re: Telnyx package compromised on PyPI

#105

Post by dist-epoch »

consp wrote: post #70
jbrowning wrote: post #10

> The payload isn't delivered as a raw binary or a Python file. It's disguised as a .wav audio file. > The WAV file is a valid audio file. It passes MIME-type checks. But the audio frame data contains a base64-encoded payload. Decode the frames, take the first 8 bytes as the XOR key, XOR the rest, and you have your executable or Python script. Talk about burying the lede.

I've seen it at least once in code from a big car manufacturer who encrypted their software or parts of it to avoid you reading the xml files. They use a key, split into two or more parts, hidden as the first bytes of some file or as plain text somewhere it would not be out of order, then recombine, run through an deobfuscation function to be an old fashioned DES or XOR key to decrypt the (usually XML, could have bee…

With homomorphic encryption you can do this now in a secure way - unbreakable client side obfuscation.

Re: Telnyx package compromised on PyPI

#106

Post by janzer »

mil22 wrote: post #23

For those using uv , you can at least partially protect yourself against such attacks by adding this to your pyproject.toml : [tool.uv] exclude-newer = "7 days" or this to your ~/.config/uv/uv.toml : exclude-newer = "7 days" This will prevent uv picking up any package version released within the last 7 days, hopefully allowing enough time for the community to detect any malware and yank the package version before you…

EDIT: This was caused by using an old version uv (0.7.3) updating with `uv self update` to the latest version (0.11.2) resolved it. Original message below:

While the first form seems to work with `pyproject.toml`, it seems like the second form in the global `uv.toml` only accepts actual dates and not relative times. Trying to put a relative time (either in the form "7 days" or "P7D") results in a failed to parse error.

Re: Telnyx package compromised on PyPI

#108

Post by dotancohen »

anthk wrote: post #75
bombcar wrote: post #56

Earlier quoted context omitted.

Until everyone waits 7 days to install everything so the compromise is discovered on the 8th day. End result will be everyone runs COBOL only.

Or Forth with scientific library, bound to the constraints. Put some HTTP library on top and some easy HTML interface from a browser with no JS/CSS3 support at all. It will look rusty but unexploitable. Enterprise computing with custom software will make a comeback to avoid these pitfalls. I depise OpenJDK/Mono because of patents but at least they come with complete defaults and a 'normal' install it's more than enou…

  > Or Forth with scientific library, bound to the constraints. Put some HTTP library on top and some easy HTML interface from a browser with no JS/CSS3 support at all. It will look rusty but unexploitable.
Let this be a lesson to you youngsters that nothing in unexploitable.

Forth has no standard library for interfacing with SQLite or any other database. You're either using 8th or the C ABI. Therefore, you'll most likely be concatenating SQL queries. Are you disciplined enough to make that properly secure? Do you know all the intricacies?

Re: Telnyx package compromised on PyPI

#110

Post by vrighter »

mil22 wrote: post #23

For those using uv , you can at least partially protect yourself against such attacks by adding this to your pyproject.toml : [tool.uv] exclude-newer = "7 days" or this to your ~/.config/uv/uv.toml : exclude-newer = "7 days" This will prevent uv picking up any package version released within the last 7 days, hopefully allowing enough time for the community to detect any malware and yank the package version before you…

if everyone waited a week, then everyb would still be installing it it the same time for the first time. This is not a solution.
Post reply on HN