Malicious Needle in a Haystack - PyPi Security Pitfalls
summary
Shows concrete PyPI attacks and defenses: demonstrates star-jacking (fake GitHub stats shown until PyPI requires uploads via trusted publisher management), documents a recent campaign of 900+ crypto‑stealing typosquat packages, and notes malicious packages typically appear within days–weeks while originals are months old. Describes supply‑chain incidents (polyfill.io takeover, XZ utils social‑engineering over two years), recommends GitHub Actions for publishing, MFA and least‑privilege tokens, secret scanners, a browser extension validator, and reporting malware via PyPI’s hidden “report” button (PyPI responds ~one day).
AI-written summary · about
chapters (11)
- 0:00Introduction to PyPi security
- 1:37Dependency risks in packages
- 5:11Star jacking explained
- 5:33Typosquatting attacks
- 8:21Malware consequences after install
- 9:24Maintainer account hijacking
- 11:58Python GitHub admin token leak
- 14:30Polyfill.io supply chain attack
- 16:37Revival hijack explained
- 17:22XZ Utils backdoor incident
- 19:10Security best practices summary
related talks
18mMalicious Needle in a Haystack – PyPi Security Pitfalls
28mpip install malware
43mHow to hack and defend (your) open source
35mSecuring Python projects Supply Chain
25m"Security considerations in Python Packaging"
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
25mBad actors vs our community: detecting software supply chain...
42mHacking the OSS Supply Chain