An Interest In:
Web News this Week
- March 31, 2024
- March 30, 2024
- March 29, 2024
- March 28, 2024
- March 27, 2024
- March 26, 2024
- March 25, 2024
Some of Our Sources
- Pearsonified
- Creative Curio
- FanExtra - PSD
- Crazy Leaf Design
- My Ink Blog
- Line 25
- 24 Ways
- Stylized Web
- Codrops
- Hashedout
Help Webnuz
Referal links:
December 4, 2019 03:25 pm
Original Link: http://rss.slashdot.org/~r/Slashdot/slashdot/~3/S-DIkWHsllo/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys
Two Malicious Python Libraries Caught Stealing SSH and GPG Keys
The Python security team removed two trojanized Python libraries from PyPI (Python Package Index) that were caught stealing SSH and GPG keys from the projects of infected developers. From a report: The two libraries were created by the same developer and mimicked other more popular libraries -- using a technique called typosquatting to register similarly-looking names. The first is "python3-dateutil," which imitated the popular "dateutil" library. The second is "jeIlyfish" (the first L is an I), which mimicked the "jellyfish" library. The two malicious clones were discovered on Sunday, December 1, by German software developer Lukas Martini. Both libraries were removed on the same day after Martini notified dateutil developers and the PyPI security team. While the python3-dateutil was created and uploaded on PyPI two days before, on November 29, the jeIlyfish library had been available for nearly a year, since December 11, 2018.Read more of this story at Slashdot.
Original Link: http://rss.slashdot.org/~r/Slashdot/slashdot/~3/S-DIkWHsllo/two-malicious-python-libraries-caught-stealing-ssh-and-gpg-keys
Share this article:
Tweet
View Full Article
Slashdot
Slashdot was originally created in September of 1997 by Rob "CmdrTaco" Malda. Today it is owned by Geeknet, Inc..More About this Source Visit Slashdot