Reported 5 malicious #Python packages to #PyPI: numberpy, tqmmd, pandans, openpyexl, reqwestss all by the same user leemay1782.
All with the same "functionality", getting commands via a socket from dzgi0h7on1jhzdg0vknw9pp9309rxjl8.oastify[.]com and executing it.
I don't think I saw the setup.py entry_points being used as a trigger mechanism before?
=== Begin ===
"Jinja2 sandbox escape via string formatting"
"Incorrect Privilege Assignment in Jinja2"
"Insecure Temporary File in Jinja2"
"Regular Expression Denial of Service (ReDoS) in Jinja2"
"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter"
"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter"
"High severity vulnerability that affects Jinja2"
=== End ===
The April 2024 release of Posit Package Manager brings support for air-gapped PyPI repositories, more flexible curated CRAN repositories, performance improvements and more!
Well, another #PyConUS is done (for me - #Sprints continue for another couple of days!)
It was excellent catching up with old friends and meeting tons of new ones. Pittsburgh was definitely a super cool vibe, 2025 should be fun too.
I'm looking forward to recharging my depleted physical batteries, so I can jump into all the important work we have ahead of us to continue to support this amazing community.
I think I have finally™️ (for the third or so time) found myself a solution for :python: #Python development on :nixos: #NixOS that allows me to just work with #pythonPoetry et. al. as on other distros.
The solution is to pre-build an FHSUserEnv in your configuration.nix, e.g. like this¹.
When starting Python dev work, I now execute fhs (it's fast!), or directly fhs -c 'poetry shell' and everything works as expected, including #PyPI wheels etc.
Very cool to see some of the hard work we’ve been doing at #ActiveState for #Python packaging with #PyPI Trusted Publishing being made available to everyone today
@Rob_Bos Great! naming-confusion is indeed a big issue and becoming more prominently present in the open source world, which is not good. I'm a package maintainer for various projects, and I notice that my projects also get cloned with malicious code. Too bad PyPi isn't handle those security issues fast enough IMO.
#Python bundles xz v5.2.5 and earlier which don't contain the backdoored binary files. #PyPI is also not affected due to using Debian Bookworm, not Sid.
Querying PyPI packages and Python Dockerhub images doesn't show any xz 5.6.x binaries.
From what I've gathered from others, the backdoor appears to target sshd (SSH server) on glibc-based distros, so if you're using Ubuntu or Fedora check that you aren't affected.
On install they decrypt Fernet encrypted code, which loads further code from https://funcaptcha[.]ru/paste2?package=asyncioo (replace the parameter with the package name).
I was blocked from accessing that code (am on mobile right now, so I don't have the means to investigate for real, Fernet decryption was already fun :abloblamp: ).