Dozens of malicious PyPI packages discovered targeting developers

Re:Dozens of malicious PyPI packages discovered targeting de... by coffeeblack on Wednesday November 02, 2022 @04:03PM (#33442152)

The only place I log into from the VM is Github, protected by 2FA in case any malware gets my password.

[ Parent | on HN ]

Re:Dozens of malicious PyPI packages discovered targeting de... by ylk on Wednesday November 02, 2022 @04:10PM (#33442266)

The malware will just take the session cookie. Some actions still require 2FA approval, but it’s not many, iirc.

[ Parent | on HN ]

Re:Dozens of malicious PyPI packages discovered targeting de... by remram on Wednesday November 02, 2022 @04:19PM (#33442390)

So the malware can delete all your projects or inject malware into them, but thankfully it won't be able to log in again later?

[ Parent | on HN ]