sjvn, to security
@sjvn@mastodon.social avatar

Malicious Package 'Pytoileur' Targets Windows and Leverages Stack Overflow for Distribution https://securityboulevard.com/2024/05/malicious-pypi-package-pytoileur-targets-windows-and-leverages-stack-overflow-for-distribution/ by @sjvn

This latest poisoned Python code used Slack Overflow to advertise itself. Happy, Happy, Joy, Joy!

dubbel, to python
@dubbel@mstdn.io avatar

Reported 5 malicious #Python packages to #PyPI: numberpy, tqmmd, pandans, openpyexl, reqwestss all by the same user leemay1782.

All with the same "functionality", getting commands via a socket from dzgi0h7on1jhzdg0vknw9pp9309rxjl8.oastify[.]com and executing it.
I don't think I saw the setup.py entry_points being used as a trigger mechanism before?

#ThreatIntel #CTI #malware

benjaoming,
@benjaoming@social.data.coop avatar

@dubbel maybe it's connected to some kind of "StackOverflow attack", where the attacker tells the user to install a package and run a command?

sjvn, to security
@sjvn@mastodon.social avatar

Malicious Package 'Pytoileur' Targets Windows and Leverages Stack Overflow for Distribution - Security Boulevard https://securityboulevard.com/2024/05/malicious-pypi-package-pytoileur-targets-windows-and-leverages-stack-overflow-for-distribution/ by @sjvn

This latest poisoned Python code used Slack Overflow to advertise itself. Happy, Happy, Joy, Joy!

fohrloop, to python
@fohrloop@fosstodon.org avatar

Can sigtore signatures be uploaded to PyPI, and is there / would there be any use for them?

I was reading through https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/ and noticed the .sigstore files were only uploaded to GitHub Releases.

sethmlarson,
@sethmlarson@fosstodon.org avatar

@fohrloop coming with PEP 740 from @yossarian https://discuss.python.org/t/pep-740-index-support-for-digital-attestations/44498

fohrloop,
@fohrloop@fosstodon.org avatar

@sethmlarson @yossarian

Thanks for the link! It So it seems that uploading signatures is not yet supported. Hope that PEP will help us get there.

SpeechToTextCloud, to python
@SpeechToTextCloud@techhub.social avatar

Search vulnerabilities in Python packages:

$ curl -sX POST -d '{"version": "2.4.1", "package": {"name": "jinja2", "ecosystem": "PyPI"}}' 'https://api.osv.dev/v1/query' | jq '.vulns[].summary | select( . != null )'

=== Begin ===
"Jinja2 sandbox escape via string formatting"
"Incorrect Privilege Assignment in Jinja2"
"Insecure Temporary File in Jinja2"
"Regular Expression Denial of Service (ReDoS) in Jinja2"
"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter"
"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter"
"High severity vulnerability that affects Jinja2"
=== End ===

Useful jq query strings:
summary, details, aliases

Posit, to python
@Posit@fosstodon.org avatar

The April 2024 release of Posit Package Manager brings support for air-gapped PyPI repositories, more flexible curated CRAN repositories, performance improvements and more!

Learn about it in the blog post: https://posit.co/blog/posit-package-manager-2024-04-0/

miketheman, to python
@miketheman@hachyderm.io avatar

Well, another is done (for me - continue for another couple of days!)

It was excellent catching up with old friends and meeting tons of new ones. Pittsburgh was definitely a super cool vibe, 2025 should be fun too.

I'm looking forward to recharging my depleted physical batteries, so I can jump into all the important work we have ahead of us to continue to support this amazing community.

See you online somewhere!!

webology,
@webology@mastodon.social avatar

@miketheman Mike, we never met, but I intended to. Next year, but I appreciate what you are bringing to the PSF.

ucodery, to random
@ucodery@fosstodon.org avatar

Inspired by all the talk about #packaging during #PyconUS I went ahead and cut another release of my #TUI #PyPI package explorer kayak: https://github.com/ucodery/kayak/releases/tag/v0.6.0
Caution, still Very rough, still Very beta

phildini, to random
@phildini@wandering.shop avatar

Wow @brainwane one-upping @freakboy3742 ‘s “Modern Django ModelForm” with the #PyPi #Wellerman

The gauntlet has been dropped for best song performance in the #python community #PyConUS

mistersql, to random
@mistersql@mastodon.social avatar

has gotten so much better security-wise over the last year. Trusted Publisher is the best

https://docs.pypi.org/trusted-publishers/

nobodyinperson, to python
@nobodyinperson@fosstodon.org avatar

I think I have finally™️ (for the third or so time) found myself a solution for :python: #Python development on :nixos: #NixOS that allows me to just work with #pythonPoetry et. al. as on other distros.

The solution is to pre-build an FHSUserEnv in your configuration.nix, e.g. like this¹.

When starting Python dev work, I now execute fhs (it's fast!), or directly fhs -c 'poetry shell' and everything works as expected, including #PyPI wheels etc.

¹https://gitlab.com/nobodyinperson/nixconfig/-/blob/main/fhs.nix?ref_type=heads

cc @publicvoit

nobodyinperson,
@nobodyinperson@fosstodon.org avatar

@docRekd @publicvoit Of course. It's not a general solution to be able to do Python dev on NixOS. One needs a separate nix file per project (that alone is an absolute no-go). Even if you take the time and try to make one, still no guarantee that it works (even with preferWheels=true!). Weird errors arise with nix' typical awful error messages and at this point it's not useable for general Python dev. Maybe for specific standalone Python projects you want to #nix-ify.

publicvoit,
@publicvoit@graz.social avatar

@nobodyinperson @docRekd I feel you pain and I'm not even trying to do Python dev but only invoking my own scripts.

I started a wrapper script that wraps nix-shell and poetry so that it does "invoke this Python file" with all its Nix-specific mumbo jumbo.

In my mind, I already quite NixOS since it complicates the most normal things so that it's adding more effort than saves me from.

pypi, to python

PyPI package maintainers can now publish via Trusted Publishing from three additional providers:

  • GitLab
  • Google Cloud
  • ActiveState

They join GitHub Actions to support publishing without long-lived passwords or API tokens.


https://blog.pypi.org/posts/2024-04-17-expanding-trusted-publisher-support/

hugovk, to python
@hugovk@mastodon.social avatar

I have a little site that shows the most downloaded packages from PyPI, updated monthly:

https://hugovk.github.io/top-pypi-packages/

Inspired by this, Vladimir Iglovikov has made a nice leaderboard showing the change from last month:

https://pypilb.vercel.app

mistersql, to random
@mistersql@mastodon.social avatar

should have a filter for project size. When the readme is longer than the code, it is a sign that maybe

  • it shouldn't be a library (vendorize those 10 lines of code)
  • it is an outline for an idea of a gist, not a library or app

I mean this is clever, but it is a long way from, say Moodle,

https://github.com/BrokenShell/MultiChoice/blob/master/MultiChoice.py

(I'm picking on pypi's search functions, not this dev. If I wanted a gist for a prompt like prompt toolkit, this would be perfect)

mistersql,
@mistersql@mastodon.social avatar

@lewiscowles1986 Yes, that's why I was suggesting it would be a nice filter, I think there are qualitative differences between large and tiny packages that could be different depending on the problem domain. At the moment, I have to read code of each package to filter. It is a slow way to search

lewiscowles1986,
@lewiscowles1986@phpc.social avatar

@mistersql
I have to do the same thing. But I still have to, even if it's a few thousand lines

CodenameTim, to python
@CodenameTim@fosstodon.org avatar

Does someone have an idea how long the PyPI organization queue is? #Python #PyPI

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • anitta
  • InstantRegret
  • mdbf
  • ngwrru68w68
  • magazineikmin
  • thenastyranch
  • rosin
  • khanakhh
  • osvaldo12
  • Youngstown
  • slotface
  • Durango
  • kavyap
  • DreamBathrooms
  • JUstTest
  • tacticalgear
  • ethstaker
  • provamag3
  • cisconetworking
  • tester
  • GTA5RPClips
  • cubers
  • everett
  • modclub
  • megavids
  • normalnudes
  • Leos
  • lostlight
  • All magazines
    •