pip install malware
summary
Claim: about 3% of PyPI packages use squatting and roughly 0.5% of downloads hit those impostors. Demonstrations show typosquat names like tool belt requests and a malicious package called not the Vonage python SDK that hides a base64‑encoded payload which downloads and runs further code; starjacking shows fake GitHub stars on the PyPI page. Example: fast api-toolkit ships malware in version 0.27. Recommended defenses include automated scanners (mend.io) and Dependabot and defensive typo‑squatting; the injected payload runs successfully when the package is imported.
AI-written summary · about
chapters (10)
- 0:00Malware on PyPI
- 2:51Malware via PyPI
- 8:13Typo squatting risks
- 10:25Typo squatting techniques
- 13:37Malware disguises packages
- 15:40Star jacking and dependency abuse
- 17:28Live malware demo
- 22:02Protecting package users
- 22:23Package maintainer security
- 25:13Summary
related talks
18mMalicious Needle in a Haystack – PyPi Security Pitfalls
20mMalicious Needle in a Haystack - PyPi Security Pitfalls
25mBad actors vs our community: detecting software supply chain...
46mSponsored Session: Malicious Package Trends Compared With Malware Evolution
24mDetección automatizada de archivos maliciosos en el repositorio PyPI
33mYour Silent Software Saboteur: Open Source Malware
26mSecure Software Supply Chains for Python
26mHow can we abuse AI hallucinations to feed the already bloated software supply chain