Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by teddyh on Tuesday March 02, 2021 @08:51AM
(#26315281)
The user account in question is named “RemindSupplyChainRisks”, so it’s pretty clearly at most a grey-hat scenario.
[ Parent
| on HN ]
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by naniwaduni on Tuesday March 02, 2021 @09:13AM
(#26315492)
You may be surprised to learn that even bad actors can choose innocuous names! They often don't if coming up with and maintaining names tends to be more expensive than it's worth when you're just going to burn them as they get caught, but it's totally viable for e.g. a targeted scenario.
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by teddyh on Tuesday March 02, 2021 @09:31AM
(#26315657)
I would think that an actual bad actor would choose an inconspicuous name, not a clear “IAmAGreyHat” name. But, of course, that’s what they’d want me to think, so who knows.
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by luismedel on Tuesday March 02, 2021 @10:14AM
(#26316109)
Continue and soon you’ll end playing an intelligence challenge in front of a iocaine-poisoned glass of wine :-)
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by yborg on Tuesday March 02, 2021 @02:42PM
(#26319548)
Jokes' on them, I've spent the last few years building up an immunity to iocaine powder.
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by ivanbakel on Tuesday March 02, 2021 @01:17PM
(#26318437)
What would be an inconspicuous name in this scenario? Unannounced typo-squatting is at best a greyhat activity - as the urban legend goes, better to be caught shagging the sheep than rustling it.