{"id":111737,"date":"2023-11-24T21:10:15","date_gmt":"2023-11-24T19:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-repozitorii-pypi-vyyavleno-okolo-5000-ostavlennyh-v-kode-sekretov-i-8-vredonosnyh-obfuskatorov"},"modified":"2023-11-24T21:10:15","modified_gmt":"2023-11-24T19:10:15","slug":"v-repozitorii-pypi-vyyavleno-okolo-5000-ostavlennyh-v-kode-sekretov-i-8-vredonosnyh-obfuskatorov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-repozitorii-pypi-vyyavleno-okolo-5000-ostavlennyh-v-kode-sekretov-i-8-vredonosnyh-obfuskatorov","title":{"rendered":"Around 5000 secrets left in the code and 8 malicious obfuscators have been identified in the PyPI repository.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitGuardian researchers have published the results of an analysis of confidential data forgotten by developers in code stored in the Python package repository PyPI (Python Package Index). After examining over 9.5 million files and 5 million package releases associated with 450,000 projects, 56,866 instances of confidential data leaks were identified. If considering only unique data, without duplication across releases, the number of identified leaks amounted to 3,938, with 2,922 projects containing at least one leak. <\/p>\n

A total of more than 150 types of sensitive information leaks have been identified, including common passwords, cryptographic keys, access tokens to cloud services, continuous integration systems, and APIs. At least 768 credentials were still active at the time of the study. Examples of popular leaks that remain relevant include access keys to Azure Active Directory, SSH credentials, MongoDB, MySQL, and PostgreSQL credentials, keys to GitHub OAuth Apps, Dropbox, and Auth0, as well as login parameters for Coinbase and Twilio. <\/p>\n

Among the increasingly popular types of leaks are access tokens for Telegram bots, the number of which doubled in early 2021 and then doubled again in spring 2023. A steady increase in leaks has also been recorded since 2020 for Google API access keys, and since 2022 for database credentials. Among the packages leading in the number of leaks are chatllm and safire, which had 209 keys for OpenAI and 320 keys for Google Cloud forgotten respectively. <\/p>\n

Among the file types where the highest number of leaks have been discovered, in addition to files with the .py extension, are .json (610 leaks), .md (270), PKG-INFO (240), METADATA (210), .txt (170), as well as README files (209) and files from directories named test (675). Many leaks are also associated with oversights and errors in excluding files when packaging. For example, files with local configuration files (.cookiecutterrc, .env, .pypirc, etc.) can be excluded from a Git repository via a .gitignore file, which is not considered when creating the package. In particular, 43 .pypirc files containing credentials for accessing PyPI were found in the repository. In 15 cases of leaks, developers did not intend to publicly publish packages initially created for internal use, but mistakenly published them to PyPI. <\/p>\n

Additionally, two more events related to PyPI can be mentioned: <\/p>\n