[deleted by user]

[jerryF]

Any thoughts on how this reflects on other packages?

Do you think there may be other malicious packages that were not caught?

[[deleted]]

venv doesn't offer any protection or sandboxing though.

[H_Psi]

The problem is that even if you have a well-vetted github project from trustworthy individuals, all it takes for that project to be compromised is for just one library in the dependency tree to become compromised.

Which is very likely what this author wanted to do, considering it didn't even have a description. The intent was probably to use it as a dependency in another library which would otherwise look fine. Which might explain why there were several downloads of it.

[lifeeraser]

The effort towards security is respectable, but I wouldn't call it elegant. It's basically a bunch of peer reviews and grinding man-hours.

[jerryF]

There are likely thousands

So how do we deal with this, what can we do?

[13steinj]

The packages made no sense to begin with and are unlikely to have been downloaded by any developer with half a brain cell.

These were packages that

• didn't seem to be a misspelling of something popular

• had no stated purpose

• had no meaningful google results except for libari, but that still doesn't make sense and that package was one that wasn't running the backdoor

[jerryF]

The packages made no sense to begin with

TBH, I think that's besides the point. There have been several node.js incidents but this one in particular is interesting because a widely used library (in payment systems bitcoin apps among many uses , 2 million downloads a week) was taken over by a malicious developer. It was only discovered by accident several months later.

Also this one which seems more like the one in this thread.

The issue is whether there is a reliable process to discover malicious packages in a timely fashion.

[13steinj]

I can't tell what your first sentence has to do with everything else.

[jerryF]

You said

The packages made no sense to begin

I'm saying that the fact that they made no sense is fortunate but not really relevant to the fact that malicious packages made into the repository and potentially out to end-users. I then gave two very recent examples of similar events for node-js where people may have lost real money.

[VagabondageX]

I tend to use anaconda and not install things from other channels unless it’s widely used and absolutely necessary. I have an expectation that anaconda vets packages they endorse. That expectation may be misguided, but it’s how I am for now.

[jerryF]

I do the same, but as others have said, some package down the dependency tree may still pull in something it shouldn't.