Is there something about Python or PyPI that makes it more attractive for malicious developers to add malware?
Is this also happening for repos for other languages (e.g. CPAN, RubyGems)?
Is this also happening for repos for other languages (e.g. CPAN, RubyGems)?
RubyGem: https://www.bleepingcomputer.com/news/security/malicious-rub...
Perl CPAN https://news.perlfoundation.org/post/malicious-code-found-in...
Many languages since then decided that causes too much overhead.
It can run code during installation phase
It’s very easy to obfuscate due to its dynamic nature. An import of urllib or os.system isn’t immediately visible at the top of a file as it would be in Java, it can be hidden in eval() or basically anywhere.
Finally, even legitimate packages have very, and I mean it, very bad names. Usually with a trailing number for no good reason. Lacking organizational namespaces. Together with a culture of using a lot of such dependencies and lacking a culture of freezing transitive versions. Blending in among those is too easy. Just take a common name and suffix it with 3.