3 ms·
What makes this exceptionally problematic is pip's behavior of --extra-index-url, commonly used for private indices. To choose between the standard index and t
by luhn 6y ago
What makes this exceptionally problematic is pip's behavior of --extra-index-url, commonly used for private indices. To choose between the standard index and the extra index, pip looks at both and takes the one with the higher version. So if an attacker uploads a public package with the same name and a high version, pip will prefer that one. This has actually happened to me, although just by accident and not malintent, and I pin and sign my dependencies so it was caught before it was deployed.
- antihero 6y agoSeems like a great attack vector for disgruntled ex-employees actually. All they'd need to do is copy the source code and names of internal packages, then release public versions with the same names and same source code, but backdoored. Developers likely wouldn't notice because things would function similarly at least for a while.