4 ms·

> The first is "python3-dateutil," which imitated the popular "dateutil" library. The second is "jeIlyfish" (the first L is an I), which mimicked the "jellyfish

> The first is "python3-dateutil," which imitated the popular "dateutil" library. The second is "jeIlyfish" (the first L is an I), which mimicked the "jellyfish" library.

F147H34D 7y ago
Wish they listed out how many installs.
- medecau 7y ago
  No info on installs but some more details on each: https://libraries.io/pypi/jeIlyfish https://libraries.io/pypi/jeIlyfish https://libraries.io/pypi/python3-dateutil https://libraries.io/pypi/python3-dateutil
- xtreak29 7y ago
  At pypistats.org download numbers of the last half year can be found. * python3-dateutil has 271 downloads from non-mirrors in last month[1] * jeilifish has only 106 downloads from non-mirrors in last month[2] [1]:https://pypistats.org/packages/python3-dateutil https://pypistats.org/packages/python3-dateutil [2]: https://pypistats.org/packages/jeilyfish https://pypistats.org/packages/jeilyfish https://news.ycombinator.com/item?id=21702973 https://news.ycombinator.com/item?id=21702973
qxnqd 7y ago
I don't get it. Who would type "pip install jeilyfish" by mistake?
- jagged-chisel 7y ago
  I can only see this working where someone would copy and paste the package name. EDIT: another vector I saw mentioned in another comment: you pull in what appears to be a 'valid' dependency, and jeIlyfish is listed as a dependency of that package; looks legit so you proceed.
  - jolmg 7y ago
    I suppose that could happen in a malicious tutorial or comment/post with the snippet, like in a StackOverflow answer.
    - bredren 7y ago
      The attacker would need to leave more footprints to do this, but yes. It is common for people to pipe up with "I wrote a thing that does this" and I imagine that results in people picking up odd packages. I think an experienced programmer probably would be less likely to do this, but perhaps a junior programmer working on a system that no one wants to support anymore introduces a "bad" module.
- zbentley 7y ago
  Regrettably some people use fonts in their terminals and IDEs which do not make the difference between uppercase I and lowercase l obvious.
- dahart 7y ago
  You don’t have to type the name of a package to install it. There are GUI package managers that use click to install. See Anaconda Navigator, for example.
- steventhedev 7y ago
  Put yourself in the attackers shoes. Your goal is to spread this to as many machines as possible. The best and easiest way to do that is to add your library as a transitive dependency. What better way to infect people than to get everyone who ran `pip install numpy`? As for getting it in, I'd push it to older projects as part of a "styling cleanup" PR because there's so much noise in the diff anyways. Imagine a PR to a project adding a transitive dependency for python3-dateutil. Most people would merge without looking twice, especially if you add some scary "this deprecates py2 support" to the PR.
- abhiTronix 7y ago
  These people did: Downloads last day: 13 Downloads last week: 103 Downloads last month: 119 Check https://pypistats.org/packages/jeilyfish https://pypistats.org/packages/jeilyfish you won't believe your own eyes.
maweki 7y ago
It isn't helping that the dateutil-library actually is "python-dateutil". This confused me this weekend as I wanted to pip install dateutil which did not work.

> The first is "python3-dateutil," which imitated the popular "dateutil" library. The second is "jeIlyfish" (the first L is an I), which mimicked the "jellyfish" library.

F147H34D 7y ago

Wish they listed out how many installs.

medecau 7y ago
No info on installs but some more details on each: https://libraries.io/pypi/jeIlyfish https://libraries.io/pypi/jeIlyfish https://libraries.io/pypi/python3-dateutil https://libraries.io/pypi/python3-dateutil
xtreak29 7y ago
At pypistats.org download numbers of the last half year can be found. * python3-dateutil has 271 downloads from non-mirrors in last month[1] * jeilifish has only 106 downloads from non-mirrors in last month[2] [1]:https://pypistats.org/packages/python3-dateutil https://pypistats.org/packages/python3-dateutil [2]: https://pypistats.org/packages/jeilyfish https://pypistats.org/packages/jeilyfish https://news.ycombinator.com/item?id=21702973 https://news.ycombinator.com/item?id=21702973

qxnqd 7y ago

I don't get it. Who would type "pip install jeilyfish" by mistake?

jagged-chisel 7y ago
I can only see this working where someone would copy and paste the package name. EDIT: another vector I saw mentioned in another comment: you pull in what appears to be a 'valid' dependency, and jeIlyfish is listed as a dependency of that package; looks legit so you proceed.
- jolmg 7y ago
  I suppose that could happen in a malicious tutorial or comment/post with the snippet, like in a StackOverflow answer.
  - bredren 7y ago
    The attacker would need to leave more footprints to do this, but yes. It is common for people to pipe up with "I wrote a thing that does this" and I imagine that results in people picking up odd packages. I think an experienced programmer probably would be less likely to do this, but perhaps a junior programmer working on a system that no one wants to support anymore introduces a "bad" module.
zbentley 7y ago
Regrettably some people use fonts in their terminals and IDEs which do not make the difference between uppercase I and lowercase l obvious.
dahart 7y ago
You don’t have to type the name of a package to install it. There are GUI package managers that use click to install. See Anaconda Navigator, for example.
steventhedev 7y ago
Put yourself in the attackers shoes. Your goal is to spread this to as many machines as possible. The best and easiest way to do that is to add your library as a transitive dependency. What better way to infect people than to get everyone who ran `pip install numpy`? As for getting it in, I'd push it to older projects as part of a "styling cleanup" PR because there's so much noise in the diff anyways. Imagine a PR to a project adding a transitive dependency for python3-dateutil. Most people would merge without looking twice, especially if you add some scary "this deprecates py2 support" to the PR.
abhiTronix 7y ago
These people did: Downloads last day: 13 Downloads last week: 103 Downloads last month: 119 Check https://pypistats.org/packages/jeilyfish https://pypistats.org/packages/jeilyfish you won't believe your own eyes.

maweki 7y ago

It isn't helping that the dateutil-library actually is "python-dateutil". This confused me this weekend as I wanted to pip install dateutil which did not work.