{"id":114648,"date":"2024-03-29T12:25:50","date_gmt":"2024-03-29T10:25:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij"},"modified":"2024-03-29T12:25:50","modified_gmt":"2024-03-29T10:25:50","slug":"pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij","title":{"rendered":"PyPI har pausat registreringen av nya anv\u00e4ndare och projekt p\u00e5 grund av en \u00f6kning av skadliga publikationer.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Python-paketarkivet PyPI (Python Package Index) har tillf\u00e4lligt f\u00f6rbjudit registrering av nya anv\u00e4ndare och skapande av nya projekt p\u00e5 grund av en p\u00e5g\u00e5ende massinladdning av skadliga paket under en automatiserad attack. Blockeringen inf\u00f6rdes efter att 566 paket med skadlig kod laddades upp till arkivet den 26 och 27 mars, stiliserade efter 16 popul\u00e4ra Python-bibliotek. <\/p>\n

Paketnamnen \u00e4r skapade med hj\u00e4lp av typning, dvs. tilldelning av liknande namn som skiljer sig med enskilda tecken, exempelvis temsorflow ist\u00e4llet f\u00f6r tensorflow, requyests ist\u00e4llet f\u00f6r requests, asyincio ist\u00e4llet f\u00f6r asyncio osv. Vid s\u00e5dana attacker r\u00e4knar g\u00e4rningspersonerna med ouppm\u00e4rksamma anv\u00e4ndare som g\u00f6r stavfel eller inte l\u00e4gger m\u00e4rke till skillnader i namnet n\u00e4r de s\u00f6ker eller f\u00f6ljer en l\u00e4nk fr\u00e5n forum och chattar d\u00e4r g\u00e4rningspersonerna l\u00e4mnar vilseledande instruktioner. <\/p>\n

Skadliga paket baseras p\u00e5 koden fr\u00e5n legitima bibliotek, d\u00e4r enskilda \u00e4ndringar inf\u00f6rs som installerar skadlig programvara i systemet, vilken s\u00f6ker och skickar konfidentiell information och filer som inneh\u00e5ller l\u00f6senord, \u00e5tkomstnycklar, kryptovaluta-pl\u00e5nb\u00f6cker, tokens och session-cookies. Den skadliga koden integreras i filen setup.py, som k\u00f6rs under installationen av paketet. Vid aktivering laddar den inf\u00f6rda \u00e4ndringen ner de skadliga komponenterna fr\u00e5n externa servern<\/a>. <\/p>\n

Under tv\u00e5 dagar laddade angripare upp 29 skadliga varianter av paketet tensorflow, 26 \u2014 BeautifulSoup, 26 \u2014 PyGame, 15 \u2014 SimpleJson, 38 \u2014 Matplotlib, 26 \u2014 PyTorch, 67 \u2014 CustomTKInter, 28 \u2014 selenium, 17 \u2014 playwright, 15 \u2014 asyncio och 67 \u2014 requirements. Dessutom har enskilda fall av f\u00f6rfalskning av biblioteken requests, py-cord, colorama, capmonstercloudclient, pillow och bip-utils identifierats. <\/p>\n

Det noteras s\u00e4rskilt en attack mot gemenskapen Top.gg, som har 170 tusen anv\u00e4ndare. Under attacken lyckades g\u00e4rningspersonen kompromettera ett GitHub-konto tillh\u00f6rande en av utvecklarna av top.gg, genom att stj\u00e4la webbl\u00e4sarcookies. Angriparen lade \u00e4ven till tre paket i PyPI-arkivet och registrerade dom\u00e4ner<\/a> pypihosted.org och pythonhosted.org, d\u00e4r en spegel f\u00f6r distribution av den skadliga beroende till paketen organiserades. <\/p>\n

Genom ett hackat konto i GitHub-f\u00f6rvaret f\u00f6r projektet top.gg, d\u00e4r Python-bindningen till API:n Top.gg lagrades, gjordes en \u00e4ndring som lade till filen requirements.txt. I filen fanns en lista \u00f6ver nedladdade beroenden, d\u00e4r en l\u00e4nk till en skadlig klon av paketet \u00abcolorama\u00bb, som var placerad p\u00e5 den falska dom\u00e4nen pypihosted.org, presenterades som en nedladdning av ett beroende fr\u00e5n ett spegel. M\u00e5let var att utvecklarna inte skulle m\u00e4rka skillnaden mot den legitima dom\u00e4nen pythonhosted.org, som vanligtvis anv\u00e4nds f\u00f6r nedladdning av paket fr\u00e5n PyPI.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u043b \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u043d\u043e\u0432\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438\u0437-\u0437\u0430 \u043d\u0435\u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u044e\u0449\u0435\u0439\u0441\u044f \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0445\u043e\u0434\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438. \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u0431\u044b\u043b\u0430 \u0432\u0432\u0435\u0434\u0435\u043d\u0430 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a 26 \u0438 27 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u0431\u044b\u043b\u043e \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043e 566 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c, \u0441\u0442\u0438\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u0434 16 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 Python-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a. \u0418\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0438\u043d\u0433\u0430, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114648","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PyPI har pausat registreringen av nya anv\u00e4ndare och projekt p\u00e5 grund av en \u00f6kning av skadliga publikationer | ProHoster","description":"Python-paketens repositorium PyPI (Python Package Index) har tillf\u00e4lligt f\u00f6rbjudit registrering av nya anv\u00e4ndare och skapande av nya projekt p\u00e5 grund av den fortsatta massinladdningen av skadliga paket.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47PyPI \u043f\u0440\u0438\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u043d\u043e\u0432\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438\u0437-\u0437\u0430 \u0432\u0441\u043f\u043b\u0435\u0441\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0439 | ProHoster","og:description":"\u0420\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u043b \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u043d\u043e\u0432\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438\u0437-\u0437\u0430 \u043d\u0435\u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u044e\u0449\u0435\u0439\u0441\u044f \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0445\u043e\u0434\u0435.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/pypi-priostanovil-registracziyu-novyh-polzovatelej-i-proektov-iz-za-vspleska-vredonosnyh-publikaczij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-29T10:25:50+00:00","article:modified_time":"2024-03-29T10:25:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114648","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:45","updated":"2026-03-05 11:10:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/114648","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=114648"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/114648\/revisions"}],"predecessor-version":[{"id":163163,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/114648\/revisions\/163163"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=114648"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=114648"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=114648"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}