Just days after a security weakness in the use of private and public registries was highlighted, the Python Package Index, also known as PyPI, has removed 3,653 malicious packages that were uploaded when the security flaw was highlighted.
PyPI is used by Python developers to add software libraries compiled by other developers, to their own projects.
It is not the only language with a package management system like this. All of it demands a level of trust. Any developer knows to review any code before importing it from an external library. However, this wisdom is not always followed.
Not a new thing
Package management systems like RubyGems, PyPI, and npm have all had to take measures like Python, to remove subverted packages in recent years. Malware authors found that if they can get their malicious code to be a part of popular libraries and apps, they become easily distributed.
Alex Birsan, a security researcher, showed just how easy it is to infiltrate the libraries, using a technique named typosquatting. The method leverages the relationship between public and private package registries.
Some of the packages removed include an implementation named CuPy, a multi-dimensional array that’s NumPy-compatible, and Nvidia’s parallel computing platform.
The supply chain hero
Python has policies in place to deal with things like this. Ee W. Durbin III, the director of the infrastructure at Python, said that thousands of malicious packages had been removed. However, he was reluctant to ban the account responsible for the malicious uploads, since they could simply just open another,
The name of the recent malware’s author is ‘RemindSupplyChainRisks’ and seems to indicate that the addition of malware was a way for the user to highlight the problem. One of the comment lines on the malware packages said ‘the purpose is to make everyone pay attention to software supply chain attacks because the risks are too great.cSeems like Python has a vigilante fan.
59 minutes ago
