Hacker News Reader

Comment by mikorym | Hacker News Reader

> The first is "python3-dateutil," which imitated the popular "dateutil" library. The second is "jeIlyfish" (the first L is an I), which mimicked the "jellyfish" library.

View on HN

It isn't helping that the dateutil-library actually is "python-dateutil". This confused me this weekend as I wanted to pip install dateutil which did not work.

I don't get it. Who would type "pip install jeilyfish" by mistake?

I can only see this working where someone would copy and paste the package name.

EDIT: another vector I saw mentioned in another comment: you pull in what appears to be a 'valid' dependency, and jeIlyfish is listed as a dependency of that package; looks legit so you proceed.

I suppose that could happen in a malicious tutorial or comment/post with the snippet, like in a StackOverflow answer.

The attacker would need to leave more footprints to do this, but yes. It is common for people to pipe up with "I wrote a thing that does this" and I imagine that results in people picking up odd packages.

I think an experienced programmer probably would be less likely to do this, but perhaps a junior programmer working on a system that no one wants to support anymore introduces a "bad" module.

Put yourself in the attackers shoes. Your goal is to spread this to as many machines as possible. The best and easiest way to do that is to add your library as a transitive dependency. What better way to infect people than to get everyone who ran `pip install numpy`? As for getting it in, I'd push it to older projects as part of a "styling cleanup" PR because there's so much noise in the diff anyways. Imagine a PR to a project adding a transitive dependency for python3-dateutil. Most people would merge without looking twice, especially if you add some scary "this deprecates py2 support" to the PR.

You don’t have to type the name of a package to install it. There are GUI package managers that use click to install. See Anaconda Navigator, for example.

These people did:

Downloads last day: 13 Downloads last week: 103 Downloads last month: 119

Check https://pypistats.org/packages/jeilyfish you won't believe your own eyes.

Regrettably some people use fonts in their terminals and IDEs which do not make the difference between uppercase I and lowercase l obvious.

Wish they listed out how many installs.

At pypistats.org download numbers of the last half year can be found. * python3-dateutil has 271 downloads from non-mirrors in last month[1]

* jeilifish has only 106 downloads from non-mirrors in last month[2]

[1]:https://pypistats.org/packages/python3-dateutil

[2]: https://pypistats.org/packages/jeilyfish

https://news.ycombinator.com/item?id=21702973

No info on installs but some more details on each:

https://libraries.io/pypi/jeIlyfish

https://libraries.io/pypi/python3-dateutil

Reply on news.ycombinator.com