10 ms·
Is there something about Python or PyPI that makes it more attractive for malicious developers to add malware? Is this also happening for repos for other langu
by rrwo 4y ago
Is there something about Python or PyPI that makes it more attractive for malicious developers to add malware?
Is this also happening for repos for other languages (e.g. CPAN, RubyGems)?
- lupire 4y agoPython is just far more popular. RubyGem: https://www.bleepingcomputer.com/news/security/malicious-rubygems-packages-used-in-cryptocurrency-supply-chain-attack/amp/ https://www.bleepingcomputer.com/news/security/malicious-rub... Perl CPAN https://news.perlfoundation.org/post/malicious-code-found-in-cpan-package https://news.perlfoundation.org/post/malicious-code-found-in...
- d4mi3n 4y agoI think this has more to due with the contexts/industries we typically see Python used in over pure popularity. If popularity was the only factor I'd expect to seeing a lot more news about these problems in Java/PHP ecosystems which are absolutely massive.
- mcdonje 4y agoI mean, PHP is pretty much a domain specific language, and we're only about a year out from log4j.
- marcinzm 4y agoJava is special since it has mandatory version pinning of all dependencies, doesn't run code at install time and uses a full url for dependency names. That means dependencies don't auto-update, don't compromise CI/CD as easily and don't get misspelled as easily (ie: people copy paste the whole name+version versus writing it from memory). Many languages since then decided that causes too much overhead.
- louislang 4y agoFor what it's worth, this happens in pretty much all the ecosystems. We have seen similar behavior in NPM, rubygems, and others. PyPI is just really popular.
- odiroot 4y agoYes, it's very very popular. And getting more popular every year.
- Too 4y agoIt’s the most popular It can run code during installation phase It’s very easy to obfuscate due to its dynamic nature. An import of urllib or os.system isn’t immediately visible at the top of a file as it would be in Java, it can be hidden in eval() or basically anywhere. Finally, even legitimate packages have very, and I mean it, very bad names. Usually with a trailing number for no good reason. Lacking organizational namespaces. Together with a culture of using a lot of such dependencies and lacking a culture of freezing transitive versions. Blending in among those is too easy. Just take a common name and suffix it with 3.