Software downloaded 30k times from PyPI ransacked developers’ machines(arstechnica.com)

19 pointsby Engineering-MD5 anni fa7 comments

Software downloaded 30k times from PyPI ransacked developers’ machines

https://arstechnica.com/gadgets/2021/07/malicious-pypi-packages-caught-stealing-developer-data-and-injecting-code/

7 comments

With the release of GitHub’s Copilot, I wonder how far we are from ML identification of malicious repositories.

remram5 anni fa

Isn't this a halting problem sort of endeavor? Figuring out if any possible input to the library triggers a "bad" outcome?

sjg0075 anni fa

Worthy startup idea!

remram5 anni fa

crev is an open-source framework trying to fix this, using a web-of-trust approach to reviews: https://github.com/crev-dev/

Currently only available for Cargo, Rust's package manager, but more integrative are being developed.

raxxorrax5 anni fa

While this is a logistical problem and people generally don't check code in the dependency tree, I already fear the security mechanisms that might spawn from this.

Engineering-MD5 anni fa

Did you have anything specific in mind?

0des5 anni fa

stdlib or die.

/me flashes obscure gang insignia