News for hackers. Stuff that matters.

A comment on Malicious PyPI packages stealing credit cards and injecting code. Parent comment

Re:Malicious PyPI packages stealing credit cards and injecti... by helsinki on Tuesday August 03, 2021 @09:46AM (#28049071)
FYI - You can overwrite an existing package’s release/version via pip (at least when using Artifactory’s PyPi). Not safe to assume pinning the version ‘freezes’ anything.
[ Parent | on HN ]
Re:Malicious PyPI packages stealing credit cards and injecti... by nerdponx on Tuesday August 03, 2021 @09:56AM (#28049215)
Make a "lockfile" with the pip-compile tool [0] that includes hashes. Unless you happen to fetch the hash after the package has been compromised, this should keep you safe from an overwritten version.

[0]: https://pypi.org/project/pip-tools/

[ Parent | on HN ]
Re:Malicious PyPI packages stealing credit cards and injecti... by oefrha on Tuesday August 03, 2021 @10:03AM (#28049299)
No, you cannot overwrite a file on PyPI once uploaded, even if you delete the release first. This policy has been in place for many years.
[ Parent | on HN ]
Re:Malicious PyPI packages stealing credit cards and injecti... by globular-toast on Tuesday August 03, 2021 @10:07AM (#28049341)
Pip also supports packages hashes so you can be sure you're getting the exact same package that you got last time.
[ Parent | on HN ]