On May 10, 2024, Phylum’s automated risk detection platform alerted us to a suspicious publication on PyPI. The package was called requests-darwin-lite and appeared to be a fork of the ever-popular requests package with a few key differences, most notably the inclusion of a malicious Go binary packed into
  • Daniel QuinnEnglish
    17•2 months ago

    Very cool trick. I’ve never been comfortable with how Python package installation is effectively arbitrary code execution. It’s also a nice reminder that installing packages into a Docker environment is generally safer than going bare back metal.

    • @Markaos
      7•2 months ago

      See? Hidden in an image, clearly that’s steganography! /s