3500 packages uploaded to PyPI, pointing to a malicious URL

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by erichurkman on Tuesday March 02, 2021 @10:03AM (#26316003)

This looks like someone trying to replicate Alex Birsan's attack on Apple, Microsoft, and others but through package confusion instead of version squatting. Reasonable speculation:

1. Host thousands of typo packages that phone home every time they are installed. Store IPs.

2. Find which companies own those IPs, filter out residential

3. Report vulnerabilities

[0] https://news.ycombinator.com/item?id=26087064

[ Parent | on HN ]

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by moviuro on Tuesday March 02, 2021 @11:50AM (#26317281)

https://incolumitas.com/2016/06/08/typosquatting-package-man...

https://news.ycombinator.com/item?id=11862217

[ Parent | on HN ]

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by uranusjr on Tuesday March 02, 2021 @02:14PM (#26319149)

Alex Birsan’s attack was much more involved and raised issues less recognised by a vast number of communities members. This one is basically typosquatting, a well known issue that Birsan’s manoeuvre did not focus on.

[ Parent | on HN ]

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by soheil on Tuesday March 02, 2021 @10:07AM (#26316040)

How hard is it to use a VPN?

[ Parent | on HN ]