Dozens of malicious PyPI packages discovered targeting developers

Re:Dozens of malicious PyPI packages discovered targeting de... by ashishbijlani on Wednesday November 02, 2022 @04:29PM (#33442506)

Plug: I've been building Packj [1] to address exactly this problem. It offers “audit” as well as “sandboxing” of PyPI/NPM/Rubygems packages and flags hidden malware or "risky” code behavior such as spawning of shell, use of SSH keys, and mismatch of GitHub code vs packaged code (provenance).

1. https://github.com/ossillate-inc/packj

[ Parent | on HN ]

Re:Dozens of malicious PyPI packages discovered targeting de... by mr_mitm on Wednesday November 02, 2022 @04:51PM (#33442740)

There is also this, although I haven't tested it yet. The approach is interesting though. https://github.com/avilum/secimport

[ Parent | on HN ]