{"id":114648,"date":"2024-03-29T12:25:50","date_gmt":"2024-03-29T10:25:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij"},"modified":"2024-03-29T12:25:50","modified_gmt":"2024-03-29T10:25:50","slug":"pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij","title":{"rendered":"A PyPI felf\u00fcggesztette az \u00faj felhaszn\u00e1l\u00f3k \u00e9s projektek regisztr\u00e1l\u00e1s\u00e1t a rosszindulat\u00fa publik\u00e1ci\u00f3k sz\u00e1m\u00e1nak n\u00f6veked\u00e9se miatt","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A Python csomagok t\u00e1rol\u00f3ja, a PyPI (Python Package Index) ideiglenesen megtiltotta az \u00faj felhaszn\u00e1l\u00f3k regisztr\u00e1l\u00e1s\u00e1t \u00e9s \u00faj projektek l\u00e9trehoz\u00e1s\u00e1t a folyamatos rosszindulat\u00fa csomagok t\u00f6meges felt\u00f6lt\u00e9se miatt, amely egy automatiz\u00e1lt t\u00e1mad\u00e1s sor\u00e1n t\u00f6rt\u00e9nt. A blok\u00e1dot az ut\u00e1n vezett\u00e9k be, hogy 26-\u00e1n \u00e9s 27-\u00e9n 566 rosszindulat\u00fa k\u00f3dot tartalmaz\u00f3 csomagot t\u00f6lt\u00f6ttek fel a t\u00e1rol\u00f3ba, amelyeket 16 n\u00e9pszer\u0171 Python k\u00f6nyvt\u00e1r st\u00edlus\u00e1ban alak\u00edtottak ki. <\/p>\n

A csomagok nevei a t\u00edpus\u00f6sszevon\u00e1s seg\u00edts\u00e9g\u00e9vel j\u00f6nnek l\u00e9tre, azaz hasonl\u00f3 nevek megad\u00e1s\u00e1val, amelyek elt\u00e9rnek n\u00e9h\u00e1ny karakterben, p\u00e9ld\u00e1ul temsorflow a tensorflow helyett, requyests a requests helyett, asyincio a asyncio helyett stb. Az ilyen t\u00e1mad\u00e1sok sor\u00e1n a t\u00e1mad\u00f3k a figyelmetlen felhaszn\u00e1l\u00f3kra t\u00e1maszkodnak, akik elg\u00e9pelnek vagy nem veszik \u00e9szre a n\u00e9v elt\u00e9r\u00e9seit, amikor a f\u00f3rumb\u00f3l vagy chatb\u0151l sz\u00e1rmaz\u00f3 linkre kattintanak. <\/p>\n

A rosszindulat\u00fa csomagok jogszer\u0171 k\u00f6nyvt\u00e1rak k\u00f3dj\u00e1n alapulnak, amelyekbe egyedi v\u00e1ltoztat\u00e1sokat \u00e9p\u00edtettek be, hogy a rendszerbe rosszindulat\u00fa szoftvert telep\u00edtsenek, amely keres \u00e9s k\u00fcld titkos adatokat \u00e9s f\u00e1jlokat, p\u00e9ld\u00e1ul jelszavakat, hozz\u00e1f\u00e9r\u00e9si kulcsokat, kriptovaluta t\u00e1rc\u00e1kat, tokeneket \u00e9s munkameneti s\u00fctiket. A rosszindulat\u00fa k\u00f3d a setup.py f\u00e1jlba van be\u00e1gyazva, amely a csomag telep\u00edt\u00e9se sor\u00e1n fut le. A telep\u00edt\u00e9s sor\u00e1n a m\u00f3dos\u00edt\u00e1s let\u00f6lti a rosszindulat\u00fa komponensek f\u0151 r\u00e9szeit egy k\u00fcls\u0151 forr\u00e1sb\u00f3l. a szerver<\/a>. <\/p>\n

K\u00e9t nap alatt a t\u00e1mad\u00f3k 29 rosszindulat\u00fa tensorflow csomagv\u00e1ltozatot, 26 — BeautifulSoup-t, 26 — PyGame-t, 15 — SimpleJson-t, 38 — Matplotlib-t, 26 — PyTorch-t, 67- CustomTKInter-t, 28 — selenium-t, 17 — playwright-t, 15 — asyncio-t \u00e9s 67 — requirements-t t\u00f6lt\u00f6ttek le. Tov\u00e1bb\u00e1 egyedi eseteket tal\u00e1ltak a requests, py-cord, colorama, capmonstercloudclient, pillow \u00e9s bip-utils k\u00f6nyvt\u00e1rak hamis\u00edt\u00e1s\u00e1ra. <\/p>\n

K\u00fcl\u00f6n eml\u00edt\u00e9st \u00e9rdemel a Top.gg k\u00f6z\u00f6ss\u00e9g elleni t\u00e1mad\u00e1s, amely 170 ezer felhaszn\u00e1l\u00f3t sz\u00e1ml\u00e1l. A t\u00e1mad\u00e1s sor\u00e1n a t\u00e1mad\u00f3 sikeresen kompromitt\u00e1lta a top.gg egyik fejleszt\u0151j\u00e9nek GitHub fi\u00f3kj\u00e1t a b\u00f6ng\u00e9sz\u0151 s\u00fctik ellop\u00e1s\u00e1val. A t\u00e1mad\u00f3 h\u00e1rom csomagot is felt\u00f6lt\u00f6tt a PyPI t\u00e1rol\u00f3ba \u00e9s regisztr\u00e1lt domainok<\/a> pypihosted.org \u00e9s pythanhosted.org, ahol t\u00fckr\u00f6t hoztak l\u00e9tre a rosszindulat\u00fa f\u00fcgg\u0151s\u00e9gek terjeszt\u00e9s\u00e9re a csomagokhoz. <\/p>\n

A top.gg projekt GitHub-repozit\u00f3rium\u00e1ba, ahol a Top.gg API-hoz \u00edrt Python k\u00f6teget t\u00e1roltak, egy felt\u00f6rt fi\u00f3kon kereszt\u00fcl m\u00f3dos\u00edt\u00e1st hajtottak v\u00e9gre, amely hozz\u00e1adott egy requirements.txt f\u00e1jlt. A f\u00e1jl tartalmazta a let\u00f6ltend\u0151 f\u00fcgg\u0151s\u00e9gek list\u00e1j\u00e1t, amelyben a f\u00fcgg\u0151s\u00e9g let\u00f6lt\u00e9se m\u00f6g\u00f6tt egy rosszindulat\u00fa colorama csomag kl\u00f3nja \u00e1llt egy hamis pypihosted.org dom\u00e9n alatt, rem\u00e9lve, hogy a fejleszt\u0151k nem veszik \u00e9szre a k\u00fcl\u00f6nbs\u00e9get a pythonhosted.org legitim domain\u00e9hez k\u00e9pest, ahonnan tipikusan a PyPI csomagok let\u00f6lt\u00e9s\u00e9re ker\u00fcl sor.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u043b \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u043d\u043e\u0432\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438\u0437-\u0437\u0430 \u043d\u0435\u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u044e\u0449\u0435\u0439\u0441\u044f \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0445\u043e\u0434\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438. \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u0431\u044b\u043b\u0430 \u0432\u0432\u0435\u0434\u0435\u043d\u0430 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a 26 \u0438 27 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u0431\u044b\u043b\u043e \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043e 566 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c, \u0441\u0442\u0438\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u0434 16 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 Python-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a. \u0418\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0438\u043d\u0433\u0430, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114648","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PyPI suspended new user and project registrations due to a surge in malicious posts | ProHoster","description":"The Python Package Index (PyPI) temporarily halted new user registrations and project creations due to ongoing mass uploads of malicious packages.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47PyPI \u043f\u0440\u0438\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u043d\u043e\u0432\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438\u0437-\u0437\u0430 \u0432\u0441\u043f\u043b\u0435\u0441\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0439 | ProHoster","og:description":"\u0420\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u043b \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u043d\u043e\u0432\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438\u0437-\u0437\u0430 \u043d\u0435\u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u044e\u0449\u0435\u0439\u0441\u044f \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0445\u043e\u0434\u0435.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-29T10:25:50+00:00","article:modified_time":"2024-03-29T10:25:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114648","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:45","updated":"2026-03-05 11:10:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/114648","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=114648"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/114648\/revisions"}],"predecessor-version":[{"id":163163,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/114648\/revisions\/163163"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=114648"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=114648"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=114648"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}