{"id":108646,"date":"2023-05-21T12:49:04","date_gmt":"2023-05-21T10:49:04","guid":{"rendered":"https:\/\/prohoster.info\/?p=108646"},"modified":"2023-05-22T10:28:56","modified_gmt":"2023-05-22T08:28:56","slug":"pypi-iz-za-vredonosnoj-aktivnosti-priostanovil-registracziyu-novyh-polzovatelej-i-proektov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/pypi-iz-za-vredonosnoj-aktivnosti-priostanovil-registracziyu-novyh-polzovatelej-i-proektov","title":{"rendered":"Due to malicious activity, PyPI has suspended the registration of new users and projects.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The Python package repository PyPI (Python Package Index) has temporarily halted the registration of new users and projects. The reason cited is a surge in malicious activity, where attackers have been publishing packages containing harmful code. It was noted that due to several administrators being on leave, the volume of registered malicious projects last week exceeded the remaining PyPI team's capacity for timely response. Developers plan to restructure some verification processes over the weekend, after which the ability to register in the repository will resume. <\/p>\n
According to the monitoring system for malicious activity by Sonatype, 6,933 malicious packages were found in the PyPI directory in March 2023, and since 2019 the total number of identified malicious packages has surpassed 115,000. In December 2022, as a result of an attack on the NuGet, NPM, and PyPI directories, the publication of 144,000 packages containing phishing and spam code was recorded. <\/p>\n
Most malicious packages disguise themselves as popular libraries using typosquatting (the practice of using similar names that differ by a few characters, such as exampl instead of example, djangoo instead of django, pyhton instead of python, etc.) \u2014 attackers rely on inattentive users who make typos or overlook the differences in names during searches. Malicious actions typically involve sending sensitive data found on the local system as a result of identifying standard files containing passwords, access keys, cryptocurrency wallets, tokens, session cookies, and other confidential information. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"