Page 7 - Python Package Index News Today

Three packages recently uploaded to PyPI contain code designed to fetch the Wacatac trojan and information stealer as a next stage payload.

The FortiGuard Labs team discovered an attack embedded in three PyPI packages called ‘colorslib’, ‘httpslib’, and “libhttps”. Read our blog to learn more.

Sigstore is an open source project launched by Linux Foundation with the goal of providing free and stable services for all developers to easily sign, verify and protect their software projects. While code signing is a valuable tool to prevent hackers from co-opting patching systems and delivering malware, it is difficult to implement in open source projects given the complexity of key management.  

The FortiGuard Labs team has discovered a new 0-day attack embedded in three PyPI packages called colorslib, httpslib, and "libhttps". They were found on January 10, 2023, by... | January 14, 2023

ESET Research releases IPyIDA 2.0, a Python plugin integrating IPython and Jupyter Notebook into IDA to help researchers solve reverse engineering problems.

Information stealers are being distributed by six malicious Python Package Index packages including discord-dev, discorder, easytimestamp, pyrologin, pythonstyles, and pyrologin all of which have already been removed, The Hacker News reports.

If you downloaded PyTorch-nightly on Linux via pip between Dec. 25, 2022, and Dec. 30, 2022, you've got trouble.

Package maintainers for open source framework PyTorch have said a malicious dependency imitating one of its own was available on a prominent code repository during the holiday season.

PyTorch is a highly prominent open-source tool for building artificial intelligence models originally developed by Meta in 2016 and is now operated under Linux Foundation.

The popular PyTorch Python project for data scientists and machine learning developers has become the latest open source project to be targeted with a dependency confusion attack.