One of the fake packages is called `felpesviadinho`, which looks like calling someone named "felpes" with a homophobic slur in Brazilian Portuguese.
Dozens of malicious PyPI packages discovered targeting developers
141–150 of 334 posts
Re: Dozens of malicious PyPI packages discovered targeting developers
#142Earlier quoted context omitted.
I don't think it makes much sense to verify pypi authors. I mean you could verify corporations and universities and that would get you far, but most of the packages you use are maintained by random people who signed up with a random email address. I think it makes more sense to verify individual releases. There are tools in that space like crev [1], vouch [2], and cargo-vet [3] that facilitate this, allowing you to t…
We've found a lot of open-source packages that are authored by (well, released by authors identified by) disposable email addresses. We were shocked to find companies doing this, too. Package Dependency land is a crazy place
The reason is obvious, people crawl pypi.org/github.com/npmjs.com and email their job posts or product launches. Every platform that requires an email and shows it publicly will necessarily get a lot of disposable ones.
Re: Dozens of malicious PyPI packages discovered targeting developers
#143It makes me very sad that something as wonderful as code, the closest we have to actual magic is tainted by this. You know how to code and you chose to spend your time doing this? What a shame
Lots of “reputable” devs write code that’s every bit as shitty as this. Somehow it’s ok when all you’re doing is spying on your users and shoving ads into their eyeballs.
Re: Dozens of malicious PyPI packages discovered targeting developers
#144This type of stuff is one reason I like vendoring all my deps in golang. You have to be very explicit about updating dependencies, which can be a big hassle, but you're required to do a git commit of all the changes, which gives you a good time to actually browse through the diffs. If you update dependencies incrementally, it's not even that big a job. Of course, this doesn't guarantee I won't miss any malicious code, but they'd have to go to much greater lengths to hide it since I'm actually browsing through all the code. I'm not sure the amount of code you'd have to read in python would be feasible, though. Definitely not for most nodejs projects, for example.
I think it's an interesting cultural phenomenon that different language communities have different levels of dependency fan-out in typical projects. There's no technical reason golang folks couldn't end up in this same situation, but for whatever reason they don't as much. And why is nodejs so much more dependency-happy than python? The languages themselves didn't cause that.
Re: Dozens of malicious PyPI packages discovered targeting developers
#145I wonder why we can’t have pip packages be published by username or organization, like pip install google/tensorflow It would significantly reduce the attack space
npm does something similar with their scoped packages. It fixes the problem for the top level packages, but you'd still have to contend with the transitive dependencies written by smaller organizations or individual contributors. In this case, you have to guarantee that no one involved in the dependency chain ever typos anything.
Re: Dozens of malicious PyPI packages discovered targeting developers
#146Earlier quoted context omitted.
Your dev machine getting pwned is bad, but your CI server getting screwed up is worse. This way you don't need to sandbox the compiler, and it can freely use system resources and access source trees. You only need to sandbox the execution. (As some people point out in this thread, editors are starting to use compilers to get overall meta-information, too-- if you can't even -view the code- to tell if it's malicious w…
> This way you don't need to sandbox the compiler, and it can freely use system resources and access source trees. You only need to sandbox the execution. If this is now only helping CI and not dev machines I don't see why it's worth the effort. Wouldn't it be much simpler and more reliable to just sandbox compilation of anything in your CI? > if you can't even -view the code- to tell if it's malicious without gettin…
You're digging in really hard trying to talk someone out of following good development practices because you don't personally think his effort is worth it. Personally, I don't think the effort being put into this argument is worth it.
Re: Dozens of malicious PyPI packages discovered targeting developers
#147Earlier quoted context omitted.
So you never run tests on your dev machine or CI/CD, and never run your code to manually test? I'm not experienced but I thought it was normal to have some way to try out what you've written on your dev machine. Is everyone else stepping through code in their head only, and their code is run for the first time when it's deployed to production?
Your dev machine getting pwned is bad, but your CI server getting screwed up is worse. This way you don't need to sandbox the compiler, and it can freely use system resources and access source trees. You only need to sandbox the execution. (As some people point out in this thread, editors are starting to use compilers to get overall meta-information, too-- if you can't even -view the code- to tell if it's malicious w…
Fancy IDEs perform code analysis and thus if you feed them something malicious I guess it’s feasible to run a shell command or similar. By definition, IDEs have to do that to compile code, run linters etc.
Re: Dozens of malicious PyPI packages discovered targeting developers
#148The guy who runs the C2 openly has the source code for the stealer on his GitHub. Why doesn't GitHub do anything about this shit? I've personally been hacked by a supply chain attack via a GitHub wiki link. I contacted GitHub support and didn't hear back from them for 3 months. They are completely useless.
Does GitHub actually prohibit programs that are up front about the fact they do something questionable? Considering there have been active repos for those steam pirating DLLs on the site for ages I thought they only really go after hidden maliciousness
Considering the entire open source pentesting community almost exclusively uses GitHub to host their projects: no. There is actual malware being hosted on GitHub, with the caveat that malware and pentest tools or proof of concept exploits are sometimes indistinguishable.
GitHub announced a few years ago that they would crack down on malware and were about to introduce some very strict T&C. After a huge backlash from the pentesters (justified in my opinion), they backpedaled a little bit. Hosting pentesting tools is fine, using GitHub as your C2 server or to to deliver malware in actual attacks is not.
Re: Dozens of malicious PyPI packages discovered targeting developers
#149Once a buddy and I reverse engineered some JS on a site that did the same thing - sent you down one rabbit hole, more obfuscated code, etc.. etc.. we eventually got to the end of it and discovered a comment: // help my name is ### // i am being held at #### (address in china) // please contact my family ### (this was in chinese, we had to translate it) Scary!
So did it seem like some kind of weird scam, or what?
Re: Dozens of malicious PyPI packages discovered targeting developers
#150Earlier quoted context omitted.
Couldn't you use someone else's IRC server, the same way you use Discord's server?
I suppose you could, but have you seen how popular new opensource projets being run these days? Young devs really loves discord to the point of hosting documentations there. I imagine young malware authors are no different.
Which, I don’t know if I’m getting old, but man that frustrates me. It’s a terrible platform for documentation. It’s barely a good text chat platform.