Malicious software libraries found in PyPI posing as well known libraries

Re:Malicious software libraries found in PyPI posing as well... by ams6110 on Friday September 15, 2017 @11:23AM (#15257880)

Doubly so since when installed on a server very often it will be done as "sudo pip install ....." (/s/pip/other-package-manager/ as needed)

[ Parent | on HN ]

Re:Malicious software libraries found in PyPI posing as well... by tekromancr on Friday September 15, 2017 @12:10PM (#15258274)

I almost never see this. Even on systems that are only running a single python project, I only ever see folks use virtualenv. The only time I ever see things installed with sudo is when the package is being installed in a docker container.

[ Parent | on HN ]

Re:Malicious software libraries found in PyPI posing as well... by jefurii on Friday September 15, 2017 @06:09PM (#15261188)

> virtualenv

Running "pip install" as a user that has access only to the virtualenv directory is sounding like a good strategy.

[ Parent | on HN ]

Re:Malicious software libraries found in PyPI posing as well... by striking on Friday September 15, 2017 @12:19PM (#15258339)

This used to be super common, though. I see it all the time in legacy apps.

[ Parent | on HN ]

Re:Malicious software libraries found in PyPI posing as well... by acdha on Friday September 15, 2017 @01:11PM (#15258830)

Yes – to the degree that it's uncommon now that's because many people in the community spent years loudly advising against it.

[ Parent | on HN ]