<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Jun 1, 2017, at 6:20 PM, Jannis Gebauer <<a href="mailto:ja.geb@me.com" class="">ja.geb@me.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><blockquote type="cite" class=""><div dir="ltr" class="">This makes me remember <a href="https://hackernoon.com/building-a-botnet-on-pypi-be1ad280b8d6" class="">https://hackernoon.com/building-a-botnet-on-pypi-be1ad280b8d6</a> on a related note.<br class=""></div></blockquote></div><div class=""><div dir="ltr" class=""><br class=""></div></div>Yep, that’s basically the same thing. Instead of using package names of builtins, the attacker is using a combination of popular apt/yum packages with a mix of package names with typos.<div class=""><br class=""></div><div class="">During development, it’s not uncommon to make mistakes like:</div><div class=""><br class=""></div><div class="">pip install requirements.txt (forgot the -r)</div><div class="">pip install requestd (typo)</div><div class="">pip install tkinter (not registered)</div><div class=""><br class=""></div><div class="">Or to use the wrong package manager (apt-get install python-dev vs. pip install python-dev). </div><div class=""><br class="">I wonder if it would make sense to build some kind of blacklist for this. According to the blog post there were close to 10k installs over a period of just three days. I believe Debian is running some kind of popularity contest for their packages which could be used to identify problematic packages. This will be a lot of manual work, but I’d work on a list like this.</div><div class=""><br class=""></div><div class=""><br class=""></div></div></div></blockquote><br class=""></div><div><br class=""></div><div>Folks have suggested mining the logs from PyPI looking for 404 results on ``/simple/`` to highlight common packages that are being installed which don’t yet exist, then using that data to inform a sort of automatic blacklist for new project names.</div><div><br class=""></div><div>Other folks have suggested that trying to use some sort of algorithm with existing names to figure out common typos is a solution.</div><div><br class=""></div><div>Ultimately the thing that’s missing is someone to spend the time to figure out a good solution and implement it. I will get to it eventually, but if someone feels enthused to make it happen sooner, then their contribution would be appreciated.</div><div class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class="">—<br class="">Donald Stufft<br class=""></div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></body></html>