Dozens of malicious PyPI packages discovered targeting developers

Re:Dozens of malicious PyPI packages discovered targeting de... by remram on Wednesday November 02, 2022 @04:41PM (#33442633)

I don't think it makes much sense to verify pypi authors. I mean you could verify corporations and universities and that would get you far, but most of the packages you use are maintained by random people who signed up with a random email address.

I think it makes more sense to verify individual releases. There are tools in that space like crev [1], vouch [2], and cargo-vet [3] that facilitate this, allowing you to trust your colleagues or specific people rather than the package authors. This seems like a much more viable solution to scale trust.

[1]: https://github.com/crev-dev/crev [2]: https://github.com/vouch-dev/vouch [3]: https://github.com/mozilla/cargo-vet

[ Parent | on HN ]

Re:Dozens of malicious PyPI packages discovered targeting de... by peteatphylum on Wednesday November 02, 2022 @04:48PM (#33442699)

We've found a lot of open-source packages that are authored by (well, released by authors identified by) disposable email addresses. We were shocked to find companies doing this, too.

Package Dependency land is a crazy place

[ Parent | on HN ]

Re:Dozens of malicious PyPI packages discovered targeting de... by remram on Wednesday November 02, 2022 @04:52PM (#33442757)

The reason is obvious, people crawl pypi.org/github.com/npmjs.com and email their job posts or product launches. Every platform that requires an email and shows it publicly will necessarily get a lot of disposable ones.

[ Parent | on HN ]