<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><blockquote type="cite" class=""><div dir="ltr" class="">This makes me remember <a href="https://hackernoon.com/building-a-botnet-on-pypi-be1ad280b8d6" class="">https://hackernoon.com/building-a-botnet-on-pypi-be1ad280b8d6</a> on a related note.<br class=""></div></blockquote></div><div class=""><div dir="ltr" class=""><br class=""></div></div>Yep, that’s basically the same thing. Instead of using package names of builtins, the attacker is using a combination of popular apt/yum packages with a mix of package names with typos.<div class=""><br class=""></div><div class="">During development, it’s not uncommon to make mistakes like:</div><div class=""><br class=""></div><div class="">pip install requirements.txt (forgot the -r)</div><div class="">pip install requestd (typo)</div><div class="">pip install tkinter (not registered)</div><div class=""><br class=""></div><div class="">Or to use the wrong package manager (apt-get install python-dev vs. pip install python-dev). </div><div class=""><br class="">I wonder if it would make sense to build some kind of blacklist for this. According to the blog post there were close to 10k installs over a period of just three days. I believe Debian is running some kind of popularity contest for their packages which could be used to identify problematic packages. This will be a lot of manual work, but I’d work on a list like this.</div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>