{"id":53561,"date":"2019-12-04T00:00:00","date_gmt":"2019-12-03T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki"},"modified":"2020-02-18T14:01:28","modified_gmt":"2020-02-18T11:01:28","slug":"v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki","title":{"rendered":"Deux biblioth\u00e8ques malveillantes identifi\u00e9es dans le catalogue de paquets Python PyPI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Dans le catalogue des paquets Python PyPI (Python Package Index) <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/dateutil\/dateutil\/issues\/984\">ont \u00e9t\u00e9 d\u00e9couvertes<\/a><\/noindex> paquets malveillants \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/pypi.org\/project\/python3-dateutil\/\">python3-dateutil<\/a><\/noindex>\u00bb et \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/pypi.org\/project\/jeIlyfish\/\">jeIlyfish<\/a><\/noindex>\u00ab qui ont \u00e9t\u00e9 t\u00e9l\u00e9charg\u00e9s par un auteur olgired2017 et se cachaient sous des paquets populaires \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/pypi.org\/project\/python-dateutil\/\">dateutil<\/a><\/noindex>\u00bb et \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/pypi.org\/project\/jellyfish\/\">jellyfish<\/a><\/noindex>\u00bb (diff\u00e9rent par l'utilisation du symbole \u00abI\u00bb (i) au lieu de \u00abl\u00bb (L) dans le nom). Apr\u00e8s l'installation des paquets concern\u00e9s sur le serveur de l'attaquant, les cl\u00e9s de cryptage et les donn\u00e9es confidentielles de l'utilisateur trouv\u00e9es dans le syst\u00e8me \u00e9taient envoy\u00e9es. Actuellement, les paquets probl\u00e9matiques ont d\u00e9j\u00e0 \u00e9t\u00e9 supprim\u00e9s du r\u00e9pertoire PyPI.<\/p>\n<p>Le code malveillant \u00e9tait pr\u00e9sent directement dans le paquet \u00abjeIlyfish\u00bb, tandis que le paquet \u00abpython3-dateutil\u00bb l'utilisait comme d\u00e9pendance.<br \/>\nLes noms ont \u00e9t\u00e9 choisis pour cibler les utilisateurs inattentifs qui pourraient faire des fautes de frappe lors de leurs recherches (<noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=44576\">typosquatting<\/a><\/noindex>). Le paquet malveillant \u00abjeIlyfish\u00bb a \u00e9t\u00e9 t\u00e9l\u00e9charg\u00e9 il y a environ un an \u2014 le 11 d\u00e9cembre 2018 et est rest\u00e9 inaper\u00e7u. Le paquet \u00abpython3-dateutil\u00bb a \u00e9t\u00e9 t\u00e9l\u00e9charg\u00e9 le 29 novembre 2019 et quelques jours plus tard, a suscit\u00e9 des soup\u00e7ons chez un des d\u00e9veloppeurs. Aucune information sur le nombre d'installations des paquets malveillants n'est fournie.<\/p>\n<p>Le paquet jellyfish contenait du code qui t\u00e9l\u00e9chargeait une liste de \u00abhashs\u00bb depuis un d\u00e9p\u00f4t externe bas\u00e9 sur GitLab. L'analyse de la logique de fonctionnement avec ces \u00abhashs\u00bb a r\u00e9v\u00e9l\u00e9 qu'ils contenaient un script encod\u00e9 \u00e0 l'aide de la fonction base64 et ex\u00e9cut\u00e9 apr\u00e8s d\u00e9codage. Le script trouvait dans le syst\u00e8me les cl\u00e9s SSH et GPG, ainsi que certains types de fichiers du r\u00e9pertoire personnel et des identifiants pour des projets PyCharm, puis les envoyait \u00e0 un serveur distant, h\u00e9berg\u00e9 dans l'infrastructure cloud de DigitalOcean.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Source : <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51975\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b &#171;python3-dateutil&#187; \u0438 &#171;jeIlyfish&#171;, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u044b \u043e\u0434\u043d\u0438\u043c \u0430\u0432\u0442\u043e\u0440\u043e\u043c olgired2017 \u0438 \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0434 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b &#171;dateutil&#187; \u0438 &#171;jellyfish&#187; (\u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0441\u0438\u043c\u0432\u043e\u043b\u0430 &#171;I&#187; (i) \u0432\u043c\u0435\u0441\u0442\u043e &#171;l&#187; (L) \u0432 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0438). \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438\u0441\u044c \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043a\u043b\u044e\u0447\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0412 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53561","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b &quot;\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b &quot;\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-12-03T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:01:28+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Deux biblioth\u00e8ques malveillantes identifi\u00e9es dans le catalogue des paquets Python PyPI | ProHoster","description":"Dans le catalogue des paquets Python PyPI (Python Package Index), des paquets malveillants ont \u00e9t\u00e9 d\u00e9couverts \"","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 | ProHoster","og:description":"\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b &quot;","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-kataloge-python-paketov-pypi-vyyavleny-dve-vredonosnye-biblioteki","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-03T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53561","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 07:52:15","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:51","updated":"2026-01-24 07:52:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/53561","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=53561"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/53561\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=53561"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=53561"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=53561"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}