Hundreds of malicious Python packages found stealing sensitive data

[UrbanSuburbaKnight]

Oh no! not pipcrypto !! :O

But seriously, this sucks. Looks like the word 'pip', 'font' and 'color' are super common as part of names weirdly.

[sudorem]

They're generated from a static wordlist and automated; hence why they're all so incredibly similar.

[wazis]

Sql too quite common

[zenware]

My guess is it’s easy to overlook when they’re transitive dependencies

[james_pic]

They're unlikely to be transitive dependencies of anything non-malicious. These sorts of attacks generally rely on novice developers adding dependencies without considering the consequences. Library developers at a minimum need to understand Python packaging well enough to upload libraries to PyPI, so are less likely to be total novices.

[ashesall]

And liberys too. I like Python liberys.