News for hackers. Stuff that matters.

A comment on Devs unknowingly use “malicious” modules snuck into official Python repository.

Re:Devs unknowingly use “malicious” modules snuck into offic... by rajangdavis on Sunday September 17, 2017 @09:40PM (#15272782)
How do you check if you are affected?
[ Parent | on HN ]
Re:Devs unknowingly use “malicious” modules snuck into offic... by jp_sc on Sunday September 17, 2017 @09:47PM (#15272815)
The list is in the advisory. Check if you have installed any of these:

  – acqusition (uploaded 2017-06-03 01:58:01, impersonates acquisition)
  – apidev-coop (uploaded 2017-06-03 05:16:08, impersonates apidev-coop_cms)
  – bzip (uploaded 2017-06-04 07:08:05, impersonates bz2file)
  – crypt (uploaded 2017-06-03 08:03:14, impersonates crypto)
  – django-server (uploaded 2017-06-02 08:22:23, impersonates django-server-guardian-api)
  – pwd (uploaded 2017-06-02 13:12:33, impersonates pwdhash)
  – setup-tools (uploaded 2017-06-02 08:54:44, impersonates setuptools)
  – telnet (uploaded 2017-06-02 15:35:05, impersonates telnetsrvlib)
  – urlib3 (uploaded 2017-06-02 07:09:29, impersonates urllib3)
  – urllib (uploaded 2017-06-02 07:03:37, impersonates urllib3)
[ Parent | on HN ]
Re:Devs unknowingly use “malicious” modules snuck into offic... by rajangdavis on Sunday September 17, 2017 @09:58PM (#15272846)
Really close call (I have the correct version of setuptools installed which is what had me worried).
[ Parent | on HN ]
Re:Devs unknowingly use “malicious” modules snuck into offic... by btown on Sunday September 17, 2017 @10:06PM (#15272875)
The advisory has a regex, but it's not formatted well for copy-paste (non-ASCII quotes!). Here's a version that works:

    pip list –format=legacy | egrep ‘^(acqusition|apidev-coop|bzip|crypt|django-server|pwd|setup-tools|telnet|urlib3|urllib) ‘
[ Parent | on HN ]
Re:Devs unknowingly use “malicious” modules snuck into offic... by hexane360 on Sunday September 17, 2017 @10:56PM (#15273076)
It appears that your version has non-ascii quotes as well.
[ Parent | on HN ]
Re:Devs unknowingly use “malicious” modules snuck into offic... by heracles on Monday September 18, 2017 @01:13AM (#15273552)
It's the ',

pip list –format=legacy | egrep '^(acqusition|apidev-coop|bzip|crypt|django-server|pwd|setup-tools|telnet|urlib3|urllib) '

works for me

[ Parent | on HN ]
Re:Devs unknowingly use “malicious” modules snuck into offic... by btown on Monday September 18, 2017 @05:00PM (#15279520)
Haha - I copied the wrong version and couldn't tell the difference! Rookie mistake.
[ Parent | on HN ]
Re:Devs unknowingly use “malicious” modules snuck into offic... by lamlam on Sunday September 17, 2017 @09:49PM (#15272817)
There are many tools that can scan your dependencies and tell you if anything is off. Here's one for reference (cannot vouch for it though as I have not used it):

https://github.com/jeremylong/DependencyCheck/blob/master/RE...

[ Parent | on HN ]
Re:Devs unknowingly use “malicious” modules snuck into offic... by potus50 on Sunday September 17, 2017 @09:45PM (#15272803)
I was wondering the same thing.. and why isn't there a list of package names included in this article?
[ Parent | on HN ]