4 ms·
interesting read. i was a bit confused at first, thinking that the malicious package names were being inserted into cut and pasted pip/apt/etc install strings.
by a-dub 4y ago
interesting read. i was a bit confused at first, thinking that the malicious package names were being inserted into cut and pasted pip/apt/etc install strings. i see now that's not happening in this scenario, but curious if that behavior has ever been observed.
- louislang 4y agoWe haven't seen this particular sort of thing just yet in packages. There was a similar attack from a few years ago called "pastejacking" that did something directionally similar to what you're suggesting though!