Dozens of malicious PyPI packages discovered targeting developers

Re:Dozens of malicious PyPI packages discovered targeting de... by zmaurelius on Wednesday November 02, 2022 @03:29PM (#33441629)

I am really surprised that there haven't been even more malicious packages distributed in the past couple of years considering the rise of cryptocurrency. Seems like a determined and malicious actor could score big by targeting the more popular wallets.

[ Parent | on HN ]

Re:Dozens of malicious PyPI packages discovered targeting de... by louislang on Wednesday November 02, 2022 @03:34PM (#33441703)

It's totally happening. We've seen packages targeting a lot of the big exchanges. Most of the packages are targeting developers directly though; attempting to exfil the users wallets/keys.

[ Parent | on HN ]

Re:Dozens of malicious PyPI packages discovered targeting de... by blktiger on Wednesday November 02, 2022 @04:02PM (#33442137)

Sonatype found a whole bunch of those and blogged about it in August. https://blog.sonatype.com/more-than-200-cryptominers-flood-n...

Disclaimer: I currently work for Sonatype, but in a different area of the company.

[ Parent | on HN ]

Re:Dozens of malicious PyPI packages discovered targeting de... by zmaurelius on Wednesday November 02, 2022 @06:39PM (#33443860)

Thanks for sharing this, I had no idea it was already this prevalent.

[ Parent | on HN ]