Python's PyPi Package Repository Temporarily Halted New Signups, Citing 'Volume of Malicious Projects' (bleepingcomputer.com) 24
On Saturday PyPI, the official third-party registry of open source Python packages, "temporarily suspended new users from signing up, and new projects from being uploaded to the platform" reports BleepingComputer.
"The volume of malicious users and malicious projects being created on the index in the past week has outpaced our ability to respond to it in a timely fashion, especially with multiple PyPI administrators on leave," stated an incident notice posted by PyPI admins Saturday.
Hours ago they posted a four-word update: "Suspension has been lifted." No details were provided, but The Hacker News writes the incident "comes as software registries such as PyPI have proven time and time again to be a popular target for attackers looking to poison the software supply chain and compromise developer environments." Earlier this week, Israeli cybersecurity startup Phylum uncovered an active malware campaign that leverages OpenAI ChatGPT-themed lures to bait developers into downloading a malicious Python module capable of stealing clipboard content in order to hijack cryptocurrency transactions. ReversingLabs, in a similar discovery, identified multiple npm packages named nodejs-encrypt-agent and nodejs-cookie-proxy-agent in the npm repository that drops a trojan called TurkoRat.
"The volume of malicious users and malicious projects being created on the index in the past week has outpaced our ability to respond to it in a timely fashion, especially with multiple PyPI administrators on leave," stated an incident notice posted by PyPI admins Saturday.
Hours ago they posted a four-word update: "Suspension has been lifted." No details were provided, but The Hacker News writes the incident "comes as software registries such as PyPI have proven time and time again to be a popular target for attackers looking to poison the software supply chain and compromise developer environments." Earlier this week, Israeli cybersecurity startup Phylum uncovered an active malware campaign that leverages OpenAI ChatGPT-themed lures to bait developers into downloading a malicious Python module capable of stealing clipboard content in order to hijack cryptocurrency transactions. ReversingLabs, in a similar discovery, identified multiple npm packages named nodejs-encrypt-agent and nodejs-cookie-proxy-agent in the npm repository that drops a trojan called TurkoRat.
Git Submodules (Score:1, Interesting)
I never really got the appeal of these "package managers" that are language specific. Too much proprietary tech constantly trying to re-invent the wheel.
In all my projects, I just use Git submodules. It is language and OS agnostic. If I need to make changes and fix bugs in any of the modules, I already have an easy way to commit them back upstream. I don't need to worry about malicious code in repositories, because its all decentralized. If someone else clones my repo, they're cleaning exact git commit hash
Re: Git Submodules (Score:5, Informative)
Re: (Score:2, Troll)
Sounds like a terrible design.
Re: Git Submodules (Score:1)
Re: (Score:2)
Yes, darkain's design for dependency management is terrible. It's terrible because it doesn't scale. It doesn't scale because git was never meant to be used that way. It's not git's fault if you choose to use a pipe wrench as a hammer.
Re: (Score:2)
The whole system is a mess. It's like people have never heard of a stable API. Public repos are rarely policed properly either, both for malware and for automated testing. It wouldn't be hard to have PyPi require a decent test suite and builds that pass it, especially for popular projects where breakage will cause a lot of problems.
Re:Git Submodules (Score:5, Interesting)
Having a broad variety of open source tools, some of which are _the_ reference tool, is useful. It happened with Perl, and Java, and is being tried with flatpacks and golang and tust. There are problems: ridiculous chains of unreliable and unpredictably incompatible dependencies are one of the risks we've seen with all of these packaging systems. Each language feels the need to re-invent the wheel because they drive on slightly different roads.
Re: (Score:2)
Like all the replacements for "old" tools that were just fine for decades. Traceroute, nslookup, ifconfig, etc etc. Tell me again why nslookup was retired and moved to legacy support?
Re: (Score:2)
Like all the replacements for "old" tools that were just fine for decades. Traceroute, nslookup, ifconfig, etc etc. Tell me again why nslookup was retired and moved to legacy support?
Because nslookup is architecturally flawed. It doesn't use bind for looksups but a separate library and algorithm and makes queries not inquired about and can give errors in unexpected ways and can fail in ways that can give misleading or incorrect errors and is semi useless for diagnosing local issues as it steps around the local system and then makes queries that are semi nonsensical that sort of made sense back when internet connections were generally intermittent and UUCP was a common way to communica
Re: (Score:2)
Each language feels the need to re-invent the wheel because they drive on slightly different roads.
Each language feels the need to re-invent the wheel because no-one bothers to look at what's gone before, as there is an irrational bias against old code.
It's because they have looked at what has gone before and realized how bad it is and thought "well, even if my new package manger is garbage at least my new package manager won't have these problems all of the other ones have"
Of the last 20 software projects I had some responsibility for securing they averaged just over 1,000 external dependancies per project. The fact that modern package managers even semi support this is both amazing and terrifying. There are real issues in trying to maintain the secu
Re: (Score:3)
Let me count the ways.
1) Hackers are constantly prying into libraries looking for vunerabilities. You are not a security expert, you didnt write the code and you probably dont have time to inspect the entire codebase (especially if its a big one). Modern dependency management gives you access to tools to ensure your notified when vunerabilities are found in
Re: (Score:2)
I think this is just "not invented here" bullshit that weaker minds love so much. There really is no sane reason for language specific repositories except to remove flexibility and tie the user to a specific product. Of course purveyors of commercial crap like that very much because suddenly the threshold when users are annoyed enough to move away is much higher. In fact, abominations like MS Windows and MS Office would very likely not exist anymore without that effect. Some organizations pretending to be a
Re: (Score:1)
Tell me about this many eyes argument.
It seems like most of those "many eyes" have been blind for a while now.
Why are people so unkind? (Score:2)
Python relies too much on package servers (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Dependency after dependency after dependency. Python is more like a set of legos that people string API calls together with than a language.
Name the language where you don't have dependencies with dependencies involved in software of any significant complexity.
Installing random python packages is a huge attack vector
Installing "random" anything packages is a huge attack vector. That's the problem here, there's not enough going on to ensure the repo is of high quality. When's the last time someone got nailed by a malicious package in a Debian repo? Packages have maintainers with verified addresses and cryptographic signatures, and not just any chucklehead can get their packages into the repo either. T
Why does these people get away with it? (Score:2)
Making and distributing fraudulent packages is a crime, yes?
How come no one goes after those making these things?
Unless a person is a politician or a lawyer, there is usually accountability.
Re: (Score:2)
Depends on the country of origin. If some Russian or Chinese (or what have you) hacker is at work here, we can guess that they may be at least partially state-sponsored.