Hacker News Reader

Comment by Jonnax | Hacker News Reader

I get the python3-dateutil because you might think it's an updated version of the standard library.

But how does jellyfish with a different char for L work? Someone would need to copy and paste it. But if they go to pypi, it won't have many installs.

Unless they started writing tutorials with:

"okay now just pip install X"

View on HN

I think the key here is that jeIlyfish had malicious code in it, and the fake python3-dateutil imported jeIlyfish. Even if you were examining the source for malicious code, you might not notice the difference between jellyfish and jeIlyfish, I guess.

The python3-dateutil listed jeilyfish as a dependency - so I'm guessing that upon installing the fake dateutil, the user would see something like "installing dependency - jeIlyfish" - which, depending on your font, may, at the very least, cause a person to google "python3 what is jellyfish" arriving at a concise description of what jellyfish is from pypi.

Then dateutil calls the code in jeilyfish.

Copy and pasting, even via word of mouth (rather than, say, a blog post or highly-google-ranked tutorial) is a surprisingly viral propagation vector.

And god help us if a malicious install command was posted, even if only for a few minutes before being edited, to a help or forum site like StackOverflow or Reddit.

Just an idea: in autocomplete scenarios, jeIlyfish comes alphabetically before jellyfish, while looking like it. That could hijack an install. I don't know if and where autocomplete can be used with PIP, though.

>But if they go to pypi, it won't have many installs

If people are using number of installs as a safety metric, can't blackhats game that by having a bot install the package many times?

If I had to guess, I'd say that the JeIlyfish package is just here to wrap the malicious code since JeIlyfish is a dependancy of the compromised python3-dateutil package.

PyCharm, Stallion, Anaconda Navigator, etc...

You don’t need to copy and paste it, or go to pypi, since there are commonly used ways to install packages by clicking on the name.

Reply on news.ycombinator.com