{"id":114648,"date":"2024-03-29T12:25:50","date_gmt":"2024-03-29T10:25:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij"},"modified":"2024-03-29T12:25:50","modified_gmt":"2024-03-29T10:25:50","slug":"pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij","title":{"rendered":"PyPI has suspended the registration of new users and projects due to a surge in malicious publications.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

The Python package repository PyPI (Python Package Index) has temporarily banned new user registrations and the creation of new projects due to a continuous massive upload of malicious packages during an automated attack. The block was implemented after 566 packages containing malicious code, disguised as 16 popular Python libraries, were uploaded to the repository on March 26 and 27. <\/p>\n

Package names were formed using typoscoping, i.e., assigning similar names differing by individual characters, such as temsorflow instead of tensorflow, requyests instead of requests, asyincio instead of asyncio, etc. In conducting such attacks, attackers rely on inattentive users who make typos or do not notice the differences in names when searching or clicking on links from forums and chats where attackers leave deceptive instructions. <\/p>\n

Malicious packages are based on the code of legitimate libraries, which incorporate specific modifications that install malware on the system to search for and send confidential data and files containing passwords, access keys, cryptocurrency wallets, tokens, and session cookies. The malicious code is embedded in the setup.py file, which runs during the package installation. During activation, the modification downloads the main malicious components from external sources. server<\/a>. <\/p>\n

In just two days, attackers uploaded 29 malicious variants of the TensorFlow package, 26 \u2014 BeautifulSoup, 26 \u2014 PyGame, 15 \u2014 SimpleJson, 38 \u2014 Matplotlib, 26 \u2014 PyTorch, 67 \u2014 CustomTKInter, 28 \u2014 Selenium, 17 \u2014 Playwright, 15 \u2014 Asyncio, and 67 \u2014 requirements. Additionally, several cases of library forgery were identified, including requests, py-cord, colorama, capmonstercloudclient, pillow, and bip-utils. <\/p>\n

A separate attack on the Top.gg community, which has 170,000 users, is noteworthy. During the attack, the perpetrator compromised the GitHub account of one of the developers of top.gg by stealing browser cookies. The attacker also added three packages to the PyPI repository and registered domains<\/a> pypihosted.org and pythanhosted.org, which were set up as mirrors to distribute the malicious dependencies for the packages. <\/p>\n

Through a compromised account in the GitHub repository of the project top.gg, which hosted a Python wrapper for the Top.gg API, a change was made to add a requirements.txt file. The file contained a list of dependencies to be downloaded, where a link to a malicious clone of the package 'colorama' was disguised as a dependency from a mirror, hosted on a fraudulent domain pypihosted.org, with the expectation that developers would not notice the difference from the legitimate domain pythonhosted.org, from which packages are usually downloaded from PyPI.
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u043b \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u043d\u043e\u0432\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438\u0437-\u0437\u0430 \u043d\u0435\u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u044e\u0449\u0435\u0439\u0441\u044f \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0445\u043e\u0434\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438. \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u0431\u044b\u043b\u0430 \u0432\u0432\u0435\u0434\u0435\u043d\u0430 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a 26 \u0438 27 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u0431\u044b\u043b\u043e \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043e 566 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c, \u0441\u0442\u0438\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u0434 16 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 Python-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a. \u0418\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0438\u043d\u0433\u0430, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114648","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PyPI has suspended new user registrations and projects due to a surge in malicious publications | ProHoster","description":"The Python Package Index (PyPI) temporarily suspended new user registrations and project creations due to ongoing mass uploads of malicious packages.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47PyPI \u043f\u0440\u0438\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u043d\u043e\u0432\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438\u0437-\u0437\u0430 \u0432\u0441\u043f\u043b\u0435\u0441\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0439 | ProHoster","og:description":"\u0420\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u043b \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u043d\u043e\u0432\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438\u0437-\u0437\u0430 \u043d\u0435\u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u044e\u0449\u0435\u0439\u0441\u044f \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0445\u043e\u0434\u0435.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-29T10:25:50+00:00","article:modified_time":"2024-03-29T10:25:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114648","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:45","updated":"2026-03-05 11:10:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/114648","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=114648"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/114648\/revisions"}],"predecessor-version":[{"id":163163,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/114648\/revisions\/163163"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=114648"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=114648"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=114648"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}