4 ms·

PyPI Suspends New User and Project Creation in Wake of Malware Campaign

16 points by louislang 3y ago

deleted 3y ago
[deleted]
jvanderbot 3y ago
Honest question: Is this unique to python? or can we expect this in Go, Rust, vcpkg, conan, etc?
- louislang 3y ago
  No, this is not unique to Python or PyPI. I'm one of the co-founders @ Phylum. We've tracked campaigns across Crates.io, Nuget, npm, PyPi, etc. see: https://blog.phylum.io/tag/research/ https://blog.phylum.io/tag/research/
sega_sai 3y ago
It is scary. Here they caught the culprit quickly, but if they've been careful, I think they would be able to stay under the radar and still infect a fair few systems. As a person who regularly runs pip install on my main desktop, I am definitely worried about arbitrary code execution that happens when you pip install. Sure I can run everything inside the container, but given that I do most of my work in python, I think that is too restrictive...
- louislang 3y ago
  Yeah, the broad campaign makes it extremely noticeable. There are active campaigns right now that don't take this approach. Singular packages with novel malicious payloads. > As a person who regularly runs pip install on my main desktop, where I am worried about arbitrary code execution that happens when you pip install. We've open-sourced a sandbox and wrapped the Phylum CLI with it so you can do something like `phylum pip install <pkgName>,` it'll check our API first for known malware, then if it appears clean, will perform the installation in the sandbox. You can specify what the sandbox is allowed to touch in a TOML file. See: https://github.com/phylum-dev/birdcage https://github.com/phylum-dev/birdcage
  - jvanderbot 3y ago
    This is great. Is there something for crates.io? Does the safety-oriented Rust community do this _automatically_?
nathants 3y ago
run littlesnitch or something similar to notice and prevent egress attempts. for now it seems the only effective defense. hopefully somebody builds a disk snitch. would love to buy that.
richij 3y ago
This one gained more traction: https://news.ycombinator.com/item?id=39856756 https://news.ycombinator.com/item?id=39856756

16 points by louislang 3y ago

deleted 3y ago

[deleted]

jvanderbot 3y ago

Honest question: Is this unique to python? or can we expect this in Go, Rust, vcpkg, conan, etc?

louislang 3y ago
No, this is not unique to Python or PyPI. I'm one of the co-founders @ Phylum. We've tracked campaigns across Crates.io, Nuget, npm, PyPi, etc. see: https://blog.phylum.io/tag/research/ https://blog.phylum.io/tag/research/

sega_sai 3y ago

It is scary. Here they caught the culprit quickly, but if they've been careful, I think they would be able to stay under the radar and still infect a fair few systems. As a person who regularly runs pip install on my main desktop, I am definitely worried about arbitrary code execution that happens when you pip install. Sure I can run everything inside the container, but given that I do most of my work in python, I think that is too restrictive...

louislang 3y ago
Yeah, the broad campaign makes it extremely noticeable. There are active campaigns right now that don't take this approach. Singular packages with novel malicious payloads. > As a person who regularly runs pip install on my main desktop, where I am worried about arbitrary code execution that happens when you pip install. We've open-sourced a sandbox and wrapped the Phylum CLI with it so you can do something like `phylum pip install <pkgName>,` it'll check our API first for known malware, then if it appears clean, will perform the installation in the sandbox. You can specify what the sandbox is allowed to touch in a TOML file. See: https://github.com/phylum-dev/birdcage https://github.com/phylum-dev/birdcage
- jvanderbot 3y ago
  This is great. Is there something for crates.io? Does the safety-oriented Rust community do this _automatically_?

nathants 3y ago

run littlesnitch or something similar to notice and prevent egress attempts. for now it seems the only effective defense. hopefully somebody builds a disk snitch. would love to buy that.

richij 3y ago

This one gained more traction: https://news.ycombinator.com/item?id=39856756 https://news.ycombinator.com/item?id=39856756