Kutholwe imitapo yolwazi emithathu eyingozi kuhla lwemibhalo lwephakheji ye-PyPI Python

Imitapo yolwazi emithathu equkethe ikhodi enonya ikhonjwe kuhla lwemibhalo lwe-PyPI (Python Package Index). Ngaphambi kokuthi izinkinga zibonakale futhi zikhishwe kukhathalogi, amaphakheji abeselandiwe cishe izikhathi eziyizinkulungwane eziyi-15.

I-dpp-client (10194 downloads) kanye ne-dpp-client1234 (1536 downloads) amaphakheji asatshalaliswe kusukela ngoFebhuwari futhi afaka ikhodi yokuthumela okuqukethwe kokuguquguquka kwemvelo, lokho, ngokwesibonelo, okungabandakanya okhiye bokufinyelela, amathokheni noma amaphasiwedi ezinhlelweni zokuhlanganisa eziqhubekayo. noma izindawo zamafu njenge-AWS. Amaphakheji aphinde athumela uhlu oluqukethe okuqukethwe kwezinkomba ze-"/home", "/mnt/mesos/" kanye ne-"mnt/mesos/sandbox" kumsingathi wangaphandle.

Iphakheji ye-aws-login0tool (okulandiwe okungu-3042) yathunyelwa endaweni ye-PyPI ngoDisemba 1 futhi yafaka ikhodi yokulanda nokusebenzisa uhlelo lwe-Trojan ukuze lilawule ababungazi abasebenzisa i-Windows. Lapho kukhethwa igama lephakeji, isibalo senziwe ngenxa yokuthi okhiye baka-“0” kanye no-“-” baseduze futhi kunethuba lokuthi unjiniyela azobhala “aws-login0tool” esikhundleni sokuthi “aws-login-tool”.

Amaphakheji ayinkinga akhonjwe ngesikhathi sokuhlolwa okulula, lapho ingxenye yamaphakheji e-PyPI (cishe amaphakheji ayizinkulungwane ezingama-200 kweziyizinkulungwane ezingama-330 endaweni yokugcina) alandwa kusetshenziswa insiza ye-Bandersnatch, okwathi ngemva kwalokho i-grep yahlonza futhi yahlaziya amaphakheji okushiwo kufayela le-setup.py Ucingo lwe-"import urllib.request", ngokuvamile lusetshenziselwa ukuthumela izicelo kubasingathi bangaphandle.

Source: opennet.ru