News for hackers. Stuff that matters.

A comment on Investigating a backdoored PyPI package targeting FastAPI applications. Parent comment

Re:Investigating a backdoored PyPI package targeting FastAPI... by capableweb on Thursday November 24, 2022 @09:54AM (#33731943)
> It is possible the original developer of the package had their account compromised and used by a malicious actor.

> whose maintainer's account was likely compromised by a malicious actor

Seems to still be speculating about the cause without diving deeper into the topic, or is there some cache invalidation of the article that is missing perhaps?

[ Parent | on HN ]
Re:Investigating a backdoored PyPI package targeting FastAPI... by christophetd on Thursday November 24, 2022 @12:24PM (#33733833)
Yes, that would be caching. We kept the first sentence, as it's still possible his account was compromised (we have no strong evidence to prove it, but no strong evidence to refute it either).
[ Parent | on HN ]
Re:Investigating a backdoored PyPI package targeting FastAPI... by capableweb on Thursday November 24, 2022 @01:27PM (#33734632)
> we have no strong evidence to prove it, but no strong evidence to refute it either

How is that different than "speculation"? That sounds like textbook definition of "speculation".

"Speculation - the activity of guessing possible answers to a question without having enough information to be certain"

[ Parent | on HN ]