More malicious packages posted to online repository. This time it’s PyPI

A stylized skull and crossbones made out of ones and zeroes.

Enlarge (credit: Getty Images)

Researchers have uncovered yet another supply chain attack targeting an open source code repository, showing that the technique, which has gained wide use in the past few years, isn’t going away anytime soon.

This time, the repository was PyPI, short for the Python Package Index, which is the official software repository for the Python programming language. Earlier this month, a contributor with the username Lolip0p uploaded three packages to PyPI titled: colorslib, httpslib, and libhttps. The contributor was careful to disguise all three as legitimate packages, in this case, as libraries for creating a terminal user interface and thread-safe connection pooling. All three packages were advertised as providing full-featured usability.

Read 8 remaining paragraphs | Comments



https://ift.tt/TqX7air

Comments