{"id":53561,"date":"2019-12-04T00:00:00","date_gmt":"2019-12-03T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki"},"modified":"2020-02-18T14:01:28","modified_gmt":"2020-02-18T11:01:28","slug":"v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/es\/blog\/news\/v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki","title":{"rendered":"Se han detectado dos bibliotecas maliciosas en el \u00edndice de paquetes de Python PyPI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>En el cat\u00e1logo de paquetes de Python PyPI (Python Package Index) <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/dateutil\/dateutil\/issues\/984\">fueron descubiertas<\/a><\/noindex> paquetes maliciosos \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/pypi.org\/project\/python3-dateutil\/\">python3-dateutil<\/a><\/noindex>\u00bb y \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/pypi.org\/project\/jeIlyfish\/\">jeIlyfish<\/a><\/noindex>\u00bb, que fueron cargados por un autor olgired2017 y se disfrazaron de paquetes populares \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/pypi.org\/project\/python-dateutil\/\">dateutil<\/a><\/noindex>\u00bb y \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/pypi.org\/project\/jellyfish\/\">jellyfish<\/a><\/noindex>\u00bb (se diferencia por el uso del s\u00edmbolo \u00abI\u00bb (i) en lugar de \u00abl\u00bb (L) en el nombre). Despu\u00e9s de instalar los paquetes mencionados en el servidor, se enviaron las claves de cifrado encontradas en el sistema y los datos confidenciales del usuario a los atacantes. Actualmente, los paquetes problem\u00e1ticos ya han sido eliminados del cat\u00e1logo de PyPI.<\/p>\n<p>El c\u00f3digo malicioso estaba presente directamente en el paquete \u00abjeIlyfish\u00bb, y el paquete \u00abpython3-dateutil\u00bb lo utiliz\u00f3 como dependencia.<br \/>\nLos nombres fueron elegidos con base en la distracci\u00f3n de los usuarios, que cometen errores tipogr\u00e1ficos al buscar (<noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=44576\">typosquatting<\/a><\/noindex>). El paquete malicioso \u00abjeIlyfish\u00bb fue cargado hace aproximadamente un a\u00f1o \u2014 el 11 de diciembre de 2018 y pas\u00f3 desapercibido. El paquete \u00abpython3-dateutil\u00bb fue cargado el 29 de noviembre de 2019 y, despu\u00e9s de unos d\u00edas, despert\u00f3 sospechas en uno de los desarrolladores. No se proporciona informaci\u00f3n sobre el n\u00famero de instalaciones de los paquetes maliciosos.<\/p>\n<p>El paquete jellyfish inclu\u00eda c\u00f3digo que cargaba una lista de \u00abhashes\u00bb desde un repositorio externo en GitLab. El an\u00e1lisis de la l\u00f3gica de trabajo con estos \u00abhashes\u00bb mostr\u00f3 que conten\u00edan un script codificado con la funci\u00f3n base64, que se ejecutaba despu\u00e9s de la decodificaci\u00f3n. El script encontraba en el sistema las claves SSH y GPG, as\u00ed como ciertos tipos de archivos del directorio personal y credenciales para proyectos de PyCharm, y luego los enviaba a un servidor externo, alojado en la infraestructura en la nube de DigitalOcean.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Fuente: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51975\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b &#171;python3-dateutil&#187; \u0438 &#171;jeIlyfish&#171;, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u044b \u043e\u0434\u043d\u0438\u043c \u0430\u0432\u0442\u043e\u0440\u043e\u043c olgired2017 \u0438 \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0434 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b &#171;dateutil&#187; \u0438 &#171;jellyfish&#187; (\u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0441\u0438\u043c\u0432\u043e\u043b\u0430 &#171;I&#187; (i) \u0432\u043c\u0435\u0441\u0442\u043e &#171;l&#187; (L) \u0432 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0438). \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438\u0441\u044c \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043a\u043b\u044e\u0447\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0412 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53561","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b &quot;\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/es\/blog\/news\/v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"es_ES\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b &quot;\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/es\/blog\/news\/v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-12-03T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:01:28+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Se han identificado dos bibliotecas maliciosas en el cat\u00e1logo de paquetes de Python PyPI | ProHoster","description":"En el cat\u00e1logo de paquetes de Python PyPI (Python Package Index) se han encontrado paquetes maliciosos \"","canonical_url":"https:\/\/prohoster.info\/es\/blog\/news\/v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 | ProHoster","og:description":"\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b &quot;","og:url":"https:\/\/prohoster.info\/es\/blog\/news\/v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-03T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53561","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 07:52:15","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:51","updated":"2026-01-24 07:52:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/53561","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=53561"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/53561\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=53561"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=53561"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=53561"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}