3 ms·
It is scary. Here they caught the culprit quickly, but if they've been careful, I think they would be able to stay under the radar and still infect a fair few s
by sega_sai 3y ago
It is scary. Here they caught the culprit quickly, but if they've been careful, I think they would be able to stay under the radar and still infect a fair few systems.
As a person who regularly runs pip install on my main desktop, I am definitely worried about arbitrary code execution that happens when you pip install.
Sure I can run everything inside the container, but given that I do most of my work in python, I think that is too restrictive...
- louislang 3y agoYeah, the broad campaign makes it extremely noticeable. There are active campaigns right now that don't take this approach. Singular packages with novel malicious payloads. > As a person who regularly runs pip install on my main desktop, where I am worried about arbitrary code execution that happens when you pip install. We've open-sourced a sandbox and wrapped the Phylum CLI with it so you can do something like `phylum pip install <pkgName>,` it'll check our API first for known malware, then if it appears clean, will perform the installation in the sandbox. You can specify what the sandbox is allowed to touch in a TOML file. See: https://github.com/phylum-dev/birdcage https://github.com/phylum-dev/birdcage
- jvanderbot 3y agoThis is great. Is there something for crates.io? Does the safety-oriented Rust community do this _automatically_?