3 ms·

As far as I understand, this is just a typosquatting attack, or more like Google SEO squatting attack. There does not exist any normal Python libraries anyone w

As far as I understand, this is just a typosquatting attack, or more like Google SEO squatting attack. There does not exist any normal Python libraries anyone would use under these names. These packages are often made as a clone from an official package, just adding a new name. There is no reason to choose a cloned package with different name over the official one. This is business as usual for PyPi. I reported ~3 cloned malicious packages last year and they were taken down. Only very inexperienced or unlucky software developer would fall for this attack, because these packages are not part of any supply chain. Thus, I feel calling this a supply chain attack is incorrect. Maybe a watering hole attack would be more closer to the truth.

woodruffw 4y ago
Correct. These kinds of spam typosquatted packages are a feature of life on public packaging indexes, especially ones that have flat namespaces. It’s not ideal, but it’s very far from a reasonable use of “0day” or an attack on an actual supply chain.
- oefrha 4y ago
  You can typosquat on non-flat indices as well: org.apache.logging.log4j => org.apoche.logging.log4j, @babel/plugin-whatever => @babal/plugin-whatever, etc. I guess one argument against that is people are less likely to type the really long names by hand. Edit: And it’s harder to land on the typo you squatted in a longer name.
  - wankle 4y ago
    https://blog.sonatype.com/malware-removed-from-maven-central https://blog.sonatype.com/malware-removed-from-maven-central "Unlike most other open source software component ecosystems, Maven is built upon a strong namespacing concept that requires that every artifact be addressed using (minimally) a three part coordinate: Group ID : Artifact ID : Version. Group IDs follow the Java Package convention which is the reverse of a development team’s DNS. For example, all Apache Software Foundation artifacts have org.apache as the start of their Group ID. Org.apache.maven is Maven, org.apache.struts is Struts etc."
DougBTX 4y ago
There was this instance which was a bit sneakier, by taking a package name in a default repository which shadowed a name in a more specialised repository: https://news.ycombinator.com/item?id=34313208 https://news.ycombinator.com/item?id=34313208

woodruffw 4y ago

Correct. These kinds of spam typosquatted packages are a feature of life on public packaging indexes, especially ones that have flat namespaces. It’s not ideal, but it’s very far from a reasonable use of “0day” or an attack on an actual supply chain.

oefrha 4y ago
You can typosquat on non-flat indices as well: org.apache.logging.log4j => org.apoche.logging.log4j, @babel/plugin-whatever => @babal/plugin-whatever, etc. I guess one argument against that is people are less likely to type the really long names by hand. Edit: And it’s harder to land on the typo you squatted in a longer name.
- wankle 4y ago
  https://blog.sonatype.com/malware-removed-from-maven-central https://blog.sonatype.com/malware-removed-from-maven-central "Unlike most other open source software component ecosystems, Maven is built upon a strong namespacing concept that requires that every artifact be addressed using (minimally) a three part coordinate: Group ID : Artifact ID : Version. Group IDs follow the Java Package convention which is the reverse of a development team’s DNS. For example, all Apache Software Foundation artifacts have org.apache as the start of their Group ID. Org.apache.maven is Maven, org.apache.struts is Struts etc."

DougBTX 4y ago

There was this instance which was a bit sneakier, by taking a package name in a default repository which shadowed a name in a more specialised repository: https://news.ycombinator.com/item?id=34313208 https://news.ycombinator.com/item?id=34313208