5 ms·

Num2words PyPI Package Compromised

22 points by varunsharma07 1y ago

varunsharma07 1y ago
Popular Python Package num2words v0.5.15 Published Without Repository Tag, Linked to Known Threat Actor
vdupras 1y ago
What a blast from the past, I created that library, what more than a decade ago? How simpler the world was back then. This was used by nobody except us for our little shitty use case. How noisy this project has become!
- arjvik 1y ago
  who currently has control over the package on PyPI? wondering how it was compromised
  - vdupras 1y ago
    I have no idea, it hasn't been me for years.
  - tardyp 1y ago
    New maintainers never bothered to change the range.. History num2words is based on an old library, pynum2word, created by Taro Ogawa in 2003. Unfortunately, the library stopped being maintained and the author can't be reached. There was another developer, Marius Grigaitis, who in 2011 added Lithuanian support, but didn't take over maintenance of the project. I am thus basing myself on Marius Grigaitis' improvements and re-publishing pynum2word as num2words. Virgil Dupras, Savoir-faire Linux
zahlman 1y ago
> The compromise was first identified through several concerning indicators: > Missing Repository Tag: Unlike previous releases, version 0.5.15 was published to PyPI without a corresponding tag in the official GitHub repository at https://github.com/savoirfairelinux/num2words/tags https://github.com/savoirfairelinux/num2words/tags > Timing Discrepancy: The package appeared on PyPI without any associated commits or release activities in the source repository > Community Alert: Security researcher @johnk3r quickly raised the alarm on social media, warning the community about potential compromise This is one of the AI "tells" that I find especially strange. It doesn't just overuse these bullet-point lists; it puts things in the list that clearly don't belong. The "community alert", of course, is not a "concerning indicator" that was used to identify the compromise. But if you take that out, "several" is a strange way to describe "two", and the whole thing would clearly be better written as free-form prose.

22 points by varunsharma07 1y ago

Popular Python Package num2words v0.5.15 Published Without Repository Tag, Linked to Known Threat Actor

What a blast from the past, I created that library, what more than a decade ago? How simpler the world was back then. This was used by nobody except us for our little shitty use case. How noisy this project has become!

arjvik 1y ago
who currently has control over the package on PyPI? wondering how it was compromised
- vdupras 1y ago
  I have no idea, it hasn't been me for years.
- tardyp 1y ago
  New maintainers never bothered to change the range.. History num2words is based on an old library, pynum2word, created by Taro Ogawa in 2003. Unfortunately, the library stopped being maintained and the author can't be reached. There was another developer, Marius Grigaitis, who in 2011 added Lithuanian support, but didn't take over maintenance of the project. I am thus basing myself on Marius Grigaitis' improvements and re-publishing pynum2word as num2words. Virgil Dupras, Savoir-faire Linux

zahlman 1y ago

> The compromise was first identified through several concerning indicators: > Missing Repository Tag: Unlike previous releases, version 0.5.15 was published to PyPI without a corresponding tag in the official GitHub repository at https://github.com/savoirfairelinux/num2words/tags https://github.com/savoirfairelinux/num2words/tags > Timing Discrepancy: The package appeared on PyPI without any associated commits or release activities in the source repository > Community Alert: Security researcher @johnk3r quickly raised the alarm on social media, warning the community about potential compromise This is one of the AI "tells" that I find especially strange. It doesn't just overuse these bullet-point lists; it puts things in the list that clearly don't belong. The "community alert", of course, is not a "concerning indicator" that was used to identify the compromise. But if you take that out, "several" is a strange way to describe "two", and the whole thing would clearly be better written as free-form prose.