Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by sodality2 on Tuesday March 02, 2021 @09:27AM
(#26315620)
It returns a null binary. Of course, this could be a targeted attack though.
[ Parent
| on HN ]
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by dthul on Tuesday March 02, 2021 @09:53AM
(#26315905)
The setup.py that I saw doesn't do anything with the response of the HTTP request so if it were indeed a targeted attack it would need to exploit some kind of weakness in the network stack. I guess that makes a targeted attack quite unlikely.