Malicious software libraries found in PyPI posing as well known libraries

Re:Malicious software libraries found in PyPI posing as well... by hannob on Friday September 15, 2017 @10:00AM (#15257196)

We're not the authors of those packages. But we own many others.

1. We're not obfuscating pingbacks.

2./3. We're raising an exception with an explanation and a link.

Just look at the code of one of our packages: https://pypi.python.org/pypi/codecs

The research in 2016 was done by someone else. The kinda crazy thing is: Some of the package names he used were made available again after that instead of being blocked... And now we own them.

[ Parent | on HN ]

Re:Malicious software libraries found in PyPI posing as well... by edraferi on Friday September 15, 2017 @10:10AM (#15257250)

Man. You're right - that's a mess.

[ Parent | on HN ]

Re:Malicious software libraries found in PyPI posing as well... by chupapuma on Friday September 15, 2017 @11:38AM (#15258014)

And just to be super clear, this is the code. Hard from scary or obfuscated:

  html = urllib_request.urlopen(
  "https://www.pytosquatting.org/pingback/pypi/{}/".format(package_name)
  )
  raise Exception(
    "This is a bogus package that should not be installed\n\n"
    "Please read https://www.pytosquatting.org"
  )

[ Parent | on HN ]

Re:Malicious software libraries found in PyPI posing as well... by sounds on Saturday September 16, 2017 @12:41AM (#15262918)

"Hard from scary or obfuscated" Maybe you are typing on mobile?

"Far from scary or obfuscated" reads more clearly.

[ Parent | on HN ]