{"id":114648,"date":"2024-03-29T12:25:50","date_gmt":"2024-03-29T10:25:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij"},"modified":"2024-03-29T12:25:50","modified_gmt":"2024-03-29T10:25:50","slug":"pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij","title":{"rendered":"PyPI wstrzyma\u0142 rejestracj\u0119 nowych u\u017cytkownik\u00f3w i projekt\u00f3w z powodu wzrostu z\u0142o\u015bliwych publikacji","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Repozytorium pakiet\u00f3w Pythona PyPI (Python Package Index) tymczasowo zablokowa\u0142o rejestracj\u0119 nowych u\u017cytkownik\u00f3w i tworzenie nowych projekt\u00f3w z powodu nieprzerwanego masowego \u0142adowania z\u0142o\u015bliwych pakiet\u00f3w w trakcie zautomatyzowanego ataku. Blokada zosta\u0142a wprowadzona po tym, jak 26 i 27 marca do repozytorium wgrano 566 pakiet\u00f3w z z\u0142o\u015bliwym kodem, stylizowanych na 16 popularnych bibliotek Pythona. <\/p>\n

Nazwy pakiet\u00f3w s\u0105 formu\u0142owane za pomoc\u0105 type squatting, tzn. przydzielanie podobnych nazw, r\u00f3\u017cni\u0105cych si\u0119 pojedynczymi znakami, np. temsorflow zamiast tensorflow, requyests zamiast requests, asyincio zamiast asyncio itp. W przypadku tego typu atak\u00f3w przest\u0119pcy polegaj\u0105 na nieuwa\u017cnych u\u017cytkownikach, kt\u00f3re pope\u0142ni\u0142y liter\u00f3wk\u0119 lub nie zauwa\u017cy\u0142y r\u00f3\u017cnic w nazwie podczas wyszukiwania lub klikania w linki z for\u00f3w i czat\u00f3w, na kt\u00f3rych przest\u0119pcy zostawiaj\u0105 zwodnicze instrukcje. <\/p>\n

Z\u0142o\u015bliwe pakiety opieraj\u0105 si\u0119 na kodzie legalnych bibliotek, w kt\u00f3re wbudowane s\u0105 pojedyncze zmiany, instaluj\u0105ce w systemie z\u0142o\u015bliwe oprogramowanie, kt\u00f3re przeszukuje i przesy\u0142a poufne dane oraz pliki zawieraj\u0105ce has\u0142a, klucze dost\u0119pu, portfele kryptograficzne, tokeny i sesyjne ciasteczka. Z\u0142o\u015bliwy kod jest wbudowywany w plik setup.py, uruchamiany podczas instalacji pakietu. W trakcie aktywacji wprowadzone zmiany \u0142aduj\u0105 podstawowe z\u0142o\u015bliwe komponenty z zewn\u0105trz. serwera<\/a>. <\/p>\n

W ci\u0105gu dw\u00f3ch dni cyberprzest\u0119pcy za\u0142adowali 29 z\u0142o\u015bliwych wariant\u00f3w pakietu tensorflow, 26 \u2014 BeautifulSoup, 26 \u2014 PyGame, 15 \u2014 SimpleJson, 38 \u2014 Matplotlib, 26 \u2014 PyTorch, 67 \u2014 CustomTKInter, 28 \u2014 selenium, 17 \u2014 playwright, 15 \u2014 asyncio oraz 67 \u2014 requirements. Dodatkowo wykryto osobne przypadki podrabiania bibliotek requests, py-cord, colorama, capmonstercloudclient, pillow oraz bip-utils. <\/p>\n

Osobno odnotowano atak na spo\u0142eczno\u015b\u0107 Top.gg, licz\u0105c\u0105 170 tysi\u0119cy u\u017cytkownik\u00f3w. W trakcie ataku przest\u0119pca zdo\u0142a\u0142 skompromitowa\u0107 konto na GitHubie jednego z deweloper\u00f3w top.gg poprzez kradzie\u017c ciasteczek przegl\u0105darki. Atakuj\u0105cy doda\u0142 r\u00f3wnie\u017c trzy pakiety do repozytorium PyPI i zarejestrowa\u0142 domeny<\/a> pypihosted.org oraz pythonhosted.org, na kt\u00f3rych zorganizowano lustro do rozprzestrzeniania z\u0142o\u015bliwej zale\u017cno\u015bci pakiet\u00f3w. <\/p>\n

Poprzez w\u0142amanie do konta w GitHubie do repozytorium projektu top.gg, w kt\u00f3rym znajdowa\u0142a si\u0119 biblioteka Python nad API Top.gg, wprowadzono zmian\u0119, dodaj\u0105c\u0105 plik requirements.txt. Plik zawiera\u0142 list\u0119 pobieranych zale\u017cno\u015bci, w kt\u00f3rej pod pretekstem pobierania zale\u017cno\u015bci z lustra znajdowa\u0142 si\u0119 odno\u015bnik do z\u0142o\u015bliwego klonu pakietu \u201ecolorama\u201d, umieszczonego na fa\u0142szywej domenie pypihosted.org, maj\u0105c nadziej\u0119, \u017ce tw\u00f3rcy nie zauwa\u017c\u0105 r\u00f3\u017cnicy z legaln\u0105 domen\u0105 pythonhosted.org, z kt\u00f3rej zazwyczaj pobierane s\u0105 pakiety z PyPI.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u043b \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u043d\u043e\u0432\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438\u0437-\u0437\u0430 \u043d\u0435\u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u044e\u0449\u0435\u0439\u0441\u044f \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0445\u043e\u0434\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438. \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u0431\u044b\u043b\u0430 \u0432\u0432\u0435\u0434\u0435\u043d\u0430 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a 26 \u0438 27 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u0431\u044b\u043b\u043e \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043e 566 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c, \u0441\u0442\u0438\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u0434 16 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 Python-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a. \u0418\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0438\u043d\u0433\u0430, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114648","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PyPI wstrzyma\u0142 rejestracj\u0119 nowych u\u017cytkownik\u00f3w i projekt\u00f3w z powodu wzrostu z\u0142o\u015bliwych publikacji | ProHoster","description":"Repozytorium pakiet\u00f3w Python PyPI (Python Package Index) tymczasowo zablokowa\u0142o rejestracj\u0119 nowych u\u017cytkownik\u00f3w i tworzenie nowych projekt\u00f3w z powodu nieustaj\u0105cego masowego \u0142adowania z\u0142o\u015bliwych pakiet\u00f3w.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47PyPI \u043f\u0440\u0438\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u043d\u043e\u0432\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438\u0437-\u0437\u0430 \u0432\u0441\u043f\u043b\u0435\u0441\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0439 | ProHoster","og:description":"\u0420\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u043b \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u043d\u043e\u0432\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438\u0437-\u0437\u0430 \u043d\u0435\u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u044e\u0449\u0435\u0439\u0441\u044f \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0445\u043e\u0434\u0435.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-29T10:25:50+00:00","article:modified_time":"2024-03-29T10:25:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114648","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:45","updated":"2026-03-05 11:10:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/114648","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=114648"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/114648\/revisions"}],"predecessor-version":[{"id":163163,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/114648\/revisions\/163163"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=114648"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=114648"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=114648"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}