Top all-time · #2522
blog.phylum.io
Company blog · blog.phylum.iosecurityprogramming
blog.phylum.io is the company blog at blog.phylum.io, writing about security and programming. Since 2020, 30 different Hacker News readers have linked it 56 times, most often “PyPI Suspends New User and Project Creation in Wake of Malware Campaign”. No feed was found, so read it on the site itself.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link Phylum posts on malicious and typosquatted packages and npm spam as examples of software supply chain attacks on PyPI and npm.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- PyPI Suspends New User and Project Creation in Wake of Malware Campaign2 people · 3 mentions · first linked 2024-03-28
- Malicious Python packages replace crypto addresses in developer clipboards2 people · 2 mentions · first linked 2022-11-07
- Spam: Unintended Consequences of Open Source Sustainability Platforms2 people · 2 mentions · first linked 2024-04-09
- Spark and Rust – How to Build Fast, Distributed and Flexible Analytics Pipelines2 people · 2 mentions · first linked 2021-10-07
- Rust Malware Staged on Crates.io2 people · 2 mentions · first linked 2023-08-25
- Using Entropy to Identify Obfuscated Malicious Code2 people · 2 mentions · first linked 2021-12-03
- How NPM Malware Works2 people · 2 mentions · first linked 2020-08-30
- Malicious Go Binary Delivered via Steganography in PyPI2 people · 2 mentions · first linked 2024-05-12
- Malicious Actors Use Unicode Support in Python to Evade Detection2 people · 2 mentions · first linked 2023-04-05
- June’s Sophisticated NPM Attack Attributed to North Korea2 people · 2 mentions · first linked 2023-07-26
What Hacker News says?
a)"Thanks to backwards compatibility, a package offered only as a source distribution and with the legacy setup.py file for configuration and metadata specification will run the code in setup.py as part of the installation." https://blog.phylum.io/python-package-installation-attacks/ b) pip now has an option _not_ to run arbitrary code by disallowing source distributions, by passing --only-binary :all: "By default,…
Comment linking /python-package-installation-attacks/
on “Switching Pip to Uv in a Dockerized Flask / Django App”Submitted Dozens of malicious PyPI packages discovered targeting developers as a story · 754 points
HN discussionSo we're specifically talking about the tea.yaml spam. More than any other topic that seems like one that is worth digging into details on rather than just shrugging and saying isolating causality is hard. If we look at the chart in the original article [0] that this one is a follow up to, the NPM spam suddenly picked up around the end of February, with new packages per day first doubling and then tripling. So this…
Comment linking /digital-detritus-unintended-consequences-of-open-source-sustainability-platforms/
on “70% of new NPM packages in last 6 months were spam”Submitted 70% of new NPM packages in last 6 months were spam as a story · 225 points
HN discussionI'm one of the co-founders @ Phylum. We've been tracking this campaign [1] (along with several other unrelated ones). The collective group of security researchers (Shoutout to https://vipyrsec.com/ ) in our Discord have been reporting these packages to PyPI for removal. If this is something you'd be interested in helping with, please join our Discord ( https://discord.gg/Fe6pr5eW6p )! Besides the gigantic analytics…
Comment linking /typosquatting-campaign-targets-python-developers/
on “PyPI halted new users and projects while it fended off supply-chain attack”Submitted Malicious Python packages replace crypto addresses in developer clipboards as a story · 92 points
HN discussionNo, this is not unique to Python or PyPI. I'm one of the co-founders @ Phylum. We've tracked campaigns across Crates.io, Nuget, npm, PyPi, etc. see: https://blog.phylum.io/tag/research/
Comment linking /tag/research/
on “PyPI Suspends New User and Project Creation in Wake of Malware Campaign”Submitted Aggressive Attack on PyPI Attempting to Deliver Rust Executable as a story · 69 points
HN discussionCo-funder @ Phylum here ( https://phylum.io ) We have been actively scanning dependencies across npm (and PyPI, RubyGems, Crates.io, etc.) for nearly three years now; quite successfully, I might add ( https://blog.phylum.io/tag/research/ ). We _automatically_ hit on this package when it was published, and our research team has been all over it. A collective of us are active in Discord ( https://discord.gg/Fe6pr5eW6p…
Comment linking /tag/research/
on “Ledger's NPM account has been hacked”Submitted PyPI Suspends New User and Project Creation in Wake of Malware Campaign as a story · 16 points
HN discussionI'm co-founder of Phylum ( https://phylum.io ), the group that originally identified/reported this campaign back in June [1] and that Github references [2] in their security alert. Happy to answer any questions about this campaign and any other supply chain attacks. 1. https://blog.phylum.io/sophisticated-ongoing-attack-discover... 2. https://github.blog/2023-07-18-security-alert-social-enginee...
Comment linking /sophisticated-ongoing-attack-discovered-on-npm/
on “Social engineering campaign targeting tech employees spreads through NPM malware”Submitted Using Entropy to Identify Obfuscated Malicious Code as a story · 14 points
HN discussionHappy to see this on HN! I'm one of the co-founders @ Phylum. We actively monitor and report on malware and software supply chain attacks across multiple ecosystems. Most notably, we were the first to identify and report on attacks carried out by North Korean state actors in NPM [1], prevented an early typosquat campaign against Rust developers on crates.io [2] and recently a faux email validation utility with a fai…
Comment linking /npm-emails-validator-package-malware/
on “Cryptocurrency Miner Masquerading as GCC Compiler Found in NPM Package”Submitted Python Crypto Library Updated to Steal Private Keys as a story · 9 points
HN discussionHappy to see this on HN! I'm one of the co-founders @ Phylum. We actively monitor and report on malware and software supply chain attacks across multiple ecosystems. Most notably, we were the first to identify and report on attacks carried out by North Korean state actors in NPM [1]. With our fairly recent addition of Crates.io support, we've begun monitoring and reporting on campaigns in the Rust ecosystem. In doin…
Comment linking /junes-sophisticated-npm-attack-attributed-to-north-korea/
on “Rust Malware Staged on Crates.io”Submitted Malicious Python Code Gains Execution as a story · 6 points
HN discussionAnother thing that Austral gets right is capability-based permissions for packages, in recognition of the growing danger of supply chain attacks. See for example https://blog.phylum.io/pypi-malware-replaces-crypto-addresse... - a bunch of typo-squatting Python packages that use setup.py to write a JavaScript file into the developer’s filesystem (specifically the Windows Start Menu) and register it as a background pr…
Comment linking /pypi-malware-replaces-crypto-addresses-in-developers-clipboard
on “What the Austral Programming Language Proves”Submitted Fake Developer Jobs Laced with Malware as a story · 5 points
HN discussionSubmitted Malicious Go Binary Delivered via Steganography in PyPI as a story · 4 points
HN discussionSubmitted Highly-Targeted Attacks Continue to Plague NPM as a story · 4 points
HN discussionSubmitted Ransomware Python Packages Currently Being Published to PyPI as a story · 4 points
HN discussionSubmitted Disrupting a PyPI Software Supply Chain Threat Actor as a story · 4 points
HN discussionSubmitted Active Typosquatting Campaign Against NPM as a story · 4 points
HN discussionSubmitted Spark and Rust – How to Build Fast, Distributed and Flexible Analytics Pipelines as a story · 4 points
HN discussionSubmitted Malicious Go Binary Delivered via Steganography in PyPI as a story · 3 points
HN discussionSubmitted Spam: Unintended Consequences of Open Source Sustainability Platforms as a story · 3 points
HN discussionSubmitted Rust Malware Staged on Crates.io as a story · 3 points
HN discussionSubmitted Mischievous NPM Publications as a story · 3 points
HN discussionSubmitted Using Entropy to Identify Obfuscated Malicious Code as a story · 3 points
HN discussionSubmitted Typosquat Campaign Targeting NPM Developers as a story · 2 points
HN discussion
