4 ms·

This is not a compromised supply chain, but fake packages. See my earlier comment here https://news.ycombinator.com/item?id=34390100 https://news.ycombinator.c

This is not a compromised supply chain, but fake packages. See my earlier comment here https://news.ycombinator.com/item?id=34390100 https://news.ycombinator.com/item?id=34390100 The fake packages are not part of any supply chain and are quite easy to detect. More serious attack would be rigging an existing widely used OSS package, but this is not what the post is about and its title is somewhat misleading.

dlor 4y ago
I disagree here - these could be targeted and just because we haven't seen impact yet doesn't mean there wasn't any. All it takes is one download from the right person then it can be pivoted into a supply chain attack.
jeroenhd 4y ago
They can definitely inadvertently be part of someone's supply line. The official repository takes precedence over any locally configured repositories (say, an in-house package named libhttps). When that package suddenly gets published onto the official repo, it may replace the intended package without the devs noticing until it's too late. I think this is a flawed design for a package management tool but it's the tool we've got. These packages could be random typosquats but they might also be targeted supply chain attacks against a specific company. With the CircleCI leak, the names of internal packages may just have leaked.
- woodruffw 4y ago
  In pip, multiple configured indexes have equal priority with first-wins on order of configuration (if memory serves); the tiebreaker is the version, so the attacker would need to publish a higher version than the one used internally. Either way, that’s not the attack described in the post, and is speculative to a degree that doesn’t warrant the “0day” descriptor. It’s also not actionable for companies that run entire PyPI mirrors rather than supplementary indexes, which is the norm.
  - DelightOne 4y ago
    Knowing the source code would make it easier.
- donmcronald 4y ago
  > The official repository takes precedence over any locally configured repositories (say, an in-house package named libhttps). Wow. I wonder how a repository manager like Nexus handles that. If there aren't any namespaces, would it suddenly go upstream and fetch something from the official repos?

dlor 4y ago

I disagree here - these could be targeted and just because we haven't seen impact yet doesn't mean there wasn't any. All it takes is one download from the right person then it can be pivoted into a supply chain attack.

jeroenhd 4y ago

They can definitely inadvertently be part of someone's supply line. The official repository takes precedence over any locally configured repositories (say, an in-house package named libhttps). When that package suddenly gets published onto the official repo, it may replace the intended package without the devs noticing until it's too late. I think this is a flawed design for a package management tool but it's the tool we've got. These packages could be random typosquats but they might also be targeted supply chain attacks against a specific company. With the CircleCI leak, the names of internal packages may just have leaked.

woodruffw 4y ago
In pip, multiple configured indexes have equal priority with first-wins on order of configuration (if memory serves); the tiebreaker is the version, so the attacker would need to publish a higher version than the one used internally. Either way, that’s not the attack described in the post, and is speculative to a degree that doesn’t warrant the “0day” descriptor. It’s also not actionable for companies that run entire PyPI mirrors rather than supplementary indexes, which is the norm.
- DelightOne 4y ago
  Knowing the source code would make it easier.
donmcronald 4y ago
> The official repository takes precedence over any locally configured repositories (say, an in-house package named libhttps). Wow. I wonder how a repository manager like Nexus handles that. If there aren't any namespaces, would it suddenly go upstream and fetch something from the official repos?