3500 packages uploaded to PyPI, pointing to a malicious URL

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by ztgasdf on Tuesday March 02, 2021 @09:26AM (#26315617)

I went to the IP and it sent a single file (1B) containing a line break. I don't know if they changed it recently, but that's what happens on that URL right now.

[ Parent | on HN ]

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by jlgaddis on Tuesday March 02, 2021 @09:55AM (#26315925)

Using which HTTP client?

To test "correctly", you'd likely want to use the requests library or, at the least, ussend the same User-Agent header that it does.

(And, for all we know, they could just be targeting certain IP addresses... or only responding the "malicious" response the first time the URL is requested per IP... or some other weird conditions that we aren't aware of.)

[ Parent | on HN ]

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by sodality2 on Tuesday March 02, 2021 @01:38PM (#26318715)

The packages do nothing with the response from the code i've seen

[ Parent | on HN ]

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by ztgasdf on Wednesday March 03, 2021 @08:58PM (#26337653)

Ah, I see. I was just using Firefox to test things out; I'm not really experienced with these things but I do know how to use curl to an extent. :D

[ Parent | on HN ]