2 ms·
I wrote a few scripts years ago to automate the creation of packages, name them something similar to a popular project (typo squatting), and then verify them by
by alexk307 3y ago
I wrote a few scripts years ago to automate the creation of packages, name them something similar to a popular project (typo squatting), and then verify them by creating a new pypi user with a new email address. The payload was just an http request to a server I ran.
Submitted this to pycon, and I let the PSF know. Neither were interested. Haven’t trusted a single Python package since.
- simonw 3y agoWhat measures would you suggest to prevent people from doing that?
- alexk307 3y agoBetter email verification (at the time there wasn’t even a captcha to solve), detection of typo squatting (pip install djanho or pip install jango), limiting number of packages that can be registered in a time period by IP and/or user, prompting the user that they’re installing a package with a single Levenshtein distance away from a top 100 package. It feels crazy that I can setup a mine field of packages that trick people into thinking they’ve installed the correct packages. It just takes one typo or mistake to install a package that runs an arbitrary potentially malicious script without warning. https://github.com/alexk307/pypi https://github.com/alexk307/pypi
- simonw 3y agoThere are measures against typo squatting now: I've attempted to publish packages and had the initial upload rejected because they are too close to the name of an existing package.