News for hackers. Stuff that matters.
Re:PyPI: Preventing ZIP parser confusion attacks on Python p... by calebbrown on Thursday August 07, 2025 @04:48PM (#44830152)
Apart from Python Wheels, the other popular ecosystems using zip files are Java jar files, and NuGet.

Of these Java is the most interesting as there a few JDKs commonly in use.

But I’m also interested in various security scanners that are built in other languages that can be fooled.

Re:PyPI: Preventing ZIP parser confusion attacks on Python p... by zahlman on Thursday August 07, 2025 @06:51PM (#44831383)
Does NPM not use zip files?

(Search results for `npm package format` are entirely not useful for figuring out what an NPM package actually consists of, beyond containing a `package.json` file. `pypi package format` results look wildly different; the first result I get is https://packaging.python.org/en/latest/discussions/package-f... which is quite comprehensive about the exact information I want — disregarding for a moment the fact that I already know this stuff ;) The NPM search results, for me, start with a Geeks4Geeks tutorial on creating a package. Is there even anything analogous to the Python Packaging Authority — misunderstood and not-actually-authoritative as it is — for NPM?)

Re:PyPI: Preventing ZIP parser confusion attacks on Python p... by pornel on Friday August 08, 2025 @06:44AM (#44835526)
npm and Cargo use gzipped tarballs.

Tar is an awful format that has multiple ways of specifying file names and file sizes, so there could be some shenanigans happening.

It's also possible to make archives have different content based on case-sensitivity of the file system.

Re:PyPI: Preventing ZIP parser confusion attacks on Python p... by zahlman on Friday August 08, 2025 @10:32AM (#44837462)
Ah. Python source distributions are the same, so there may be additional considerations there. Though in general it doesn't seem like there's much concern in the Python ecosystem about that, considering that building them will run arbitrary code anyway....