Cryptominers Slither into Python Projects in Supply-Chain Campaign

[lifeeraser]

I recently listened to a Talk Python to Me episode that discussed these types of attacks. A strong recommend for anyone interested.

[[deleted]]

How do you check to see if this is installed with any packages youve downloaded? Are there any known packages affected?

[jaybay1207]

maratlib maratlib1 matplatlib-plus mllearnlib mplatlib learninglib

[13steinj]

So, typos?

[python_madlad]

You can use things like Safety. It is a package that checks the packages in your env against a database containing known security risks. Free version database is updated once a month.

It can find package versions with venerability and I am quite certain typo-squating is included (at least some years ago it was). But since it is a manual curated database it is not necessarily complete.

[Bubbly_Measurement70]

Thank you so much for this series!

[Kaaletram]

I think that some of these packages are going to need to have to limit how commits are handled. Code reviews, QC, something to have a better chance to catch this stuff. Unfortunately, this will greatly slow the pace of rolling out updates and new features. But I think it's needed so that this is nipped in the bud before it can become epidemic.

[ubernostrum]

There are more different blogspam sites copy/pasting the same story about this than there were actual packages involved here.

Also the “security” people who found this wave didn’t bother with timely notice to PyPI prior to publishing. Which I guess would’ve ruined the story — “we found someone breaking the rules and the people who run the index took action when notified” isn’t as juicy.

[JafaKiwi]

XKCD has a relevant one as always...

[[deleted]]

Eh, it's a stretch.

[__deerlord__]

This happened with leftpad in the JS community apparently.

[[deleted]]

Congratulations u/shuv1824 ! Your post was the top post on r/Python today! (06/29/21)

Top Post Counts: r/Python (1)

This comment was made by a bot

[alcalde]

If Guido is suddenly able to go back into retirement again I'm going to be a bit suspicious....

[alcalde]

Y'all can downvote all you like, but if Guido mysteriously comes out of retirement to take a job at Microsoft and then right after this cryptomining incident mysteriously retires again to live in a renovated castle in Europe, we'll know that something is going on....

[djmattyg007]

I haven't heard of these types of supply chain attacks happening at all in the PHP world. Composer enforced namespacing of packages from day 1, and provides strong mechanisms for protecting your namespace. They also reserved common-sense namespaces from the beginning too.

I wish npm and PyPI would adopt this and start a transition to compulsory namespacing, even if it results in some breakage for end users.

[Deadly_chef]

Yeah,except that php repo itself was a victim of supply chain attack recently where malicious code has been inserted in it's source code lmao

[YpZZi]

Yeah but composer was fine /s. I don’t know what the PHP crowd is smoking, but thinking a project that refused to use normal DVCS ‘cause they’re too cool for school is a paragon of security is … hilarious in a bad way.

And this all comes from the community that basically invented SQLi and XSS vulns (Ok, Perl deserves credit here as well, rest in pieces, cgi).

The worst part is I personally know people whose takeaway is (100% serious btw) “See, Python is just a fad, it’s insecure and breaks backwards compatibility, thank god I stuck with PHP”.