Dozens of malicious PyPI packages discovered targeting developers

Re:Dozens of malicious PyPI packages discovered targeting de... by dheera on Wednesday November 02, 2022 @06:16PM (#33443679)

Another thing I think might help is

(a) Discourage any future use of ">=" in version dependencies. Specify an exact version. That way a future compromised version doesn't get pulled

(b) Every build system needs better ways of having multiple versions of a same dependency coexist. I should be able to have one of my project's dependencies depend on "numpy==1.15" and another dependency depend on "numpy==1.16" and they should be able to coexist in the SAME environment and "see" exactly the numpy versions they requested.

For python we should think about how to support something like this in the future:

    import numpy==1.15

and have it just work.

That way if a hacker compromises PyPI and releases a malicious numpy 1.19 it won't get pulled in accidentally.

Here's a bit of a joke I made before that might be an interesting starting point, though since it uses virtualenv behind the hood it doesn't have a way for multiple versions of one package to exist. I don't think it's impossible to do though with some additional work.

https://github.com/dheera/magicimport.py

Sample code:

    from magicimport import magicimport
    tornado = magicimport("tornado", version = "4.5")

[ Parent | on HN ]

Re:Dozens of malicious PyPI packages discovered targeting de... by cozzyd on Wednesday November 02, 2022 @06:56PM (#33444020)

Would you run into dynamic linker problems in this case due to symbol conflicts? Or does symbol versioning magically resolve that somehow?

[ Parent | on HN ]

Re:Dozens of malicious PyPI packages discovered targeting de... by dheera on Wednesday November 02, 2022 @07:21PM (#33444239)

Prefix all symbols with versions?

foo() becomes v1_15_4_foo() automatically

[ Parent | on HN ]

Re:Dozens of malicious PyPI packages discovered targeting de... by MikePlacid on Wednesday November 02, 2022 @07:00PM (#33444059)

> I should be able to have one of my project's dependencies depend on "numpy==1.15" and another dependency depend on "numpy==1.16" and they should be able to coexist in the SAME environment

Now I see what people at one respectable, big project were thinking when they allowed 7 different versions of OpenSSL to be statically linked to the same executable…

Seriously, this idea may save you from some not very interesting work, but it will create the need of much bigger amount of work which while potentially interesting is not very productive. You are toying with exponential growth here, like a chain reaction - like a bomb.

[ Parent | on HN ]