Malicious PyPI packages stealing credit cards and injecting code (jfrog.com)

Article summary

Researchers have discovered several malicious Python packages on PyPI, the Python package repository, which were designed to steal credit card information, Discord authentication tokens, and inject code. The packages were downloaded around 30,000 times before being removed. The malware used simple obfuscation techniques and was able to gather system information and upload it to a webhook. The incident highlights the risks of trusting packages from public repositories without proper vetting.

Main themes

• PyPI security
• malicious packages
• credit card fraud
• dependency management
• software security
• package repositories

What commenters say

• Some commenters believe that the risk of credit card fraud is low due to zero liability protection, making it unnecessary to take extreme measures to protect card information.
• Others argue that it is still important to take precautions to avoid credit card fraud, such as not storing card information online or using virtual cards.
• There is a disagreement about the effectiveness of relying on package repositories like PyPI, with some arguing that it is necessary to use them while others believe that it is better to use trusted internal repositories.
• Some commenters suggest that using credit cards instead of debit cards can provide better protection against fraud.
• The use of password managers and browser extensions to generate virtual cards is seen as a convenient and secure way to make online transactions.
• There is a concern that the complexity of modern software development, with many dependencies and libraries, makes it difficult to ensure the security of packages and dependencies.
• Pinning dependencies by hash is seen as a possible solution to ensure the security of packages, but others argue that using a separate artifact server is still necessary.