News for hackers. Stuff that matters.
Re:3500 packages uploaded to PyPI, pointing to a malicious URL by dthul on Tuesday March 02, 2021 @09:25AM (#26315604)
"Sends a request to a malicious URL". Malicious is relative of course.

The code reads:

    url = "http://101.32.99.28/name?<package_name>"
    requests.get(url, timeout=30)
So it looks like the author wants to track the number of installs. Nothing is done with the response value (at least for the setup.py that I saw).

Edit: seems to be a Tokyo based IP.

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by sodality2 on Tuesday March 02, 2021 @09:32AM (#26315677)
The IP is from "Tencent Building, Kejizhongyi Avenue". That's weird, if it was just because they were an ISP, why would it say "Tencent Building"?

https://ipapi.co/101.32.99.28/

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by capableweb on Tuesday March 02, 2021 @09:36AM (#26315721)
Ultimately up to the owner of the ASN what to use as the organization name. In this case, the ASN chose the name "Tencent Building, Kejizhongyi Avenue", you can see it over at https://bgp.he.net/AS132203 (The ASN is the owner of this specific IP under their specific ranges that they own)
Re:3500 packages uploaded to PyPI, pointing to a malicious URL by robjan on Tuesday March 02, 2021 @09:38AM (#26315739)
Looks like the first line of the address for the headquarters of Tencent Cloud in Shenzhen.
Re:3500 packages uploaded to PyPI, pointing to a malicious URL by dthul on Tuesday March 02, 2021 @09:36AM (#26315722)
That surprised me too (the IP lookup I used said "domain: tencent.com") but I don't understand enough about IP to tell whether that's unusual or not.

Unrelated tidbit: tencent.com returns an empty reply for me at the moment.

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by capableweb on Tuesday March 02, 2021 @09:39AM (#26315745)
> tencent.com returns an empty reply for me at the moment

That's because the correct address is https://www.tencent.com/ (prefixed with www.)

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by sodality2 on Tuesday March 02, 2021 @09:42AM (#26315780)
Wow. Can the massive chinese conglomerate really not forward that to www?
Re:3500 packages uploaded to PyPI, pointing to a malicious URL by basilgohar on Tuesday March 02, 2021 @09:57AM (#26315946)
They are hardly the only site to do that. It is only by convention that non-www-prefixed websites tend to redirect to www-prefixed one. It's not at all mandatory and technically they are two different hostnames. It may be intentional to ensure only exactly the right hostnames are ever used, e.g., www, ftp, smtp, etc.
Re:3500 packages uploaded to PyPI, pointing to a malicious URL by oefrha on Tuesday March 02, 2021 @11:54AM (#26317338)
Rather unusual, but it’s a corporate rather than customer-facing website so not really all that important. It’s not like apple.com, google.com, or microsoft.com where the brand name domain is the product or is where the products are sold. I just checked and apex domains for all their flagship products redirect to www just fine.
Re:3500 packages uploaded to PyPI, pointing to a malicious URL by deelowe on Tuesday March 02, 2021 @10:08AM (#26316051)
Seems to be working as intended, it's a non www url.
Re:3500 packages uploaded to PyPI, pointing to a malicious URL by sodality2 on Tuesday March 02, 2021 @10:37AM (#26316368)
I rarely see a site that doesn't redirect it to the appropriate subdomain. Then again I don't often check it unless it's broken
Re:3500 packages uploaded to PyPI, pointing to a malicious URL by dthul on Tuesday March 02, 2021 @09:47AM (#26315823)
Oh, nice catch! Strange setup.
Re:3500 packages uploaded to PyPI, pointing to a malicious URL by genmon on Tuesday March 02, 2021 @09:38AM (#26315736)
Assuming requester IPs are being logged, this is a good way to build a map of potentially vulnerable organisations. No need to do anything now.