{"id":139864,"date":"2025-07-31T23:11:58","date_gmt":"2025-07-31T21:11:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/perehvacheny-4-uchyotnye-zapisi-v-pypi-i-vypushheny-vredonosnye-relizy-num2words"},"modified":"2025-07-31T23:11:58","modified_gmt":"2025-07-31T21:11:58","slug":"perehvacheny-4-uchyotnye-zapisi-v-pypi-i-vypushheny-vredonosnye-relizy-num2words","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/perehvacheny-4-uchyotnye-zapisi-v-pypi-i-vypushheny-vredonosnye-relizy-num2words","title":{"rendered":"4 account su PyPI sono stati compromessi e sono state rilasciate versioni malevole di num2words","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00c8 emersa la notizia riguardante le vittime di phishing di cui recentemente hanno avvisato gli amministratori del repository dei pacchetti Python, PyPI (Python Package Index). A seguito dell'invio di messaggi che richiedevano la conferma dell'email, linkati a un sito falso pypj.org (la lettera «j» al posto della «i»), sono state compromesse le credenziali di 4 manutentori. <\/p>\n

In risultato, gli aggressori hanno generato due token per l'accesso all'API e sono state pubblicate due versioni del progetto num2words (0.5.15 e 0.5.16) contenenti codice malevolo. Il modulo num2words, che ha oltre 3 milioni di download al mese, fornisce funzioni per la conversione di numeri in rappresentazione testuale. Le versioni malevole di num2words sono state rimosse dagli amministratori di PyPI un'ora dopo la pubblicazione. <\/p>\n

Per eludere la protezione dell'account tramite l'autenticazione a due fattori, gli attaccanti hanno utilizzato un proxy trasparente del traffico dal sito di phishing pypj.org al sito reale pypi.org, creando cos\u00ec per l'utente la sensazione di interagire con il vero catalogo PyPI. Anche la pagina di accesso \u00e8 stata proxyata e gli attaccanti hanno controllato non solo la password fornita inizialmente, ma anche la risposta alla verifica del secondo fattore di autenticazione. <\/p>\n

Per contrastare futuri attacchi attraverso la proxyizzazione, gli amministratori di PyPI hanno implementato una protezione che verifica il dominio tramite JavaScript lato client e, in caso di hash non corrispondenti, domini<\/a> emette un avviso (niente impedisce all'attaccante, a livello di proxy, di filtrare tale script o di sostituire l'hash di verifica).
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u0436\u0435\u0440\u0442\u0432\u0430\u0445 \u0444\u0438\u0448\u0438\u043d\u0433\u0430, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043d\u0430 \u0434\u043d\u044f\u0445 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index). \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0441 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435\u043c \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u0442\u044c \u0441\u0432\u043e\u0439 email, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0441\u044b\u043b\u0430\u043b\u0438\u0441\u044c \u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0441\u0430\u0439\u0442 pypj.org (\u0431\u0443\u043a\u0432\u0430 «j» \u0432\u043c\u0435\u0441\u0442\u043e «i»), \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 4 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445. \u0412 \u0438\u0442\u043e\u0433\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0431\u044b\u043b\u0438 \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0434\u0432\u0430 \u0442\u043e\u043a\u0435\u043d\u0430 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a API […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-139864","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Intercettati 4 account su PyPI e rilasciate versioni malevole di num2words | ProHoster","description":"Sono emerse informazioni sulle vittime di phishing, di cui hanno avvertito nei giorni scorsi gli amministratori del repository dei pacchetti Python PyPI (Python Package Index). A seguito dell'invio di messaggi che richiedevano la conferma dell'email, con un link a un falso sito pypj.org (la lettera \"j\" al posto della \"i\"), sono state compromesse le credenziali di 4 maintainer. Di conseguenza, i criminali hanno generato due token per l'accesso all'API.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/perehvacheny-4-uchyotnye-zapisi-v-pypi-i-vypushheny-vredonosnye-relizy-num2words","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0435\u0440\u0435\u0445\u0432\u0430\u0447\u0435\u043d\u044b 4 \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 PyPI \u0438 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0440\u0435\u043b\u0438\u0437\u044b num2words | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u0436\u0435\u0440\u0442\u0432\u0430\u0445 \u0444\u0438\u0448\u0438\u043d\u0433\u0430, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043d\u0430 \u0434\u043d\u044f\u0445 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index). \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0441 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435\u043c \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u0442\u044c \u0441\u0432\u043e\u0439 email, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0441\u044b\u043b\u0430\u043b\u0438\u0441\u044c \u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0441\u0430\u0439\u0442 pypj.org (\u0431\u0443\u043a\u0432\u0430 "j" \u0432\u043c\u0435\u0441\u0442\u043e "i"), \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 4 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445. \u0412 \u0438\u0442\u043e\u0433\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0431\u044b\u043b\u0438 \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0434\u0432\u0430 \u0442\u043e\u043a\u0435\u043d\u0430 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a API","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/perehvacheny-4-uchyotnye-zapisi-v-pypi-i-vypushheny-vredonosnye-relizy-num2words","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-07-31T21:11:58+00:00","article:modified_time":"2025-07-31T21:11:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"139864","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-11 11:16:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:03:23","updated":"2026-02-11 11:16:23"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/139864","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=139864"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/139864\/revisions"}],"predecessor-version":[{"id":160582,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/139864\/revisions\/160582"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=139864"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=139864"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=139864"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}