Re: Developers are advised to purge these malicious packages

2019-12-07 Thread David Lowry-Duda
On Wed, Dec 04, 2019 at 07:17:58PM +0100, Christian Heimes wrote: > > At least the first pages are packaging files for Debian, Fedora, and > other Linux distributions. Downstream distributions provide a Python > > > > Attackers abuse the fact and try to typo-squat packages in hope that > somebod

Re: Developers are advised to purge these malicious packages

2019-12-05 Thread Pankaj Jangid
Christian Heimes writes: > On 04/12/2019 18.59, David Lowry-Duda wrote: >> I notice that "python3-dateutil" is in over 4000 github repositories >> [1]. That sounds like a disaster. >> >> [1]: https://github.com/search?q=python3-dateutil&type=Code > > At least the first pages are packaging files

Re: Developers are advised to purge these malicious packages

2019-12-04 Thread Michael Torrie
On 12/4/19 10:59 AM, David Lowry-Duda wrote: > I notice that "python3-dateutil" is in over 4000 github repositories > [1]. That sounds like a disaster. > > [1]: https://github.com/search?q=python3-dateutil&type=Code It's clearly not, as Christian has already said. In fact it would be very diffic

Re: Developers are advised to purge these malicious packages

2019-12-04 Thread Christian Heimes
On 04/12/2019 18.59, David Lowry-Duda wrote: > I notice that "python3-dateutil" is in over 4000 github repositories > [1]. That sounds like a disaster. > > [1]: https://github.com/search?q=python3-dateutil&type=Code At least the first pages are packaging files for Debian, Fedora, and other Linux

Re: Developers are advised to purge these malicious packages

2019-12-04 Thread David Lowry-Duda
I notice that "python3-dateutil" is in over 4000 github repositories [1]. That sounds like a disaster. [1]: https://github.com/search?q=python3-dateutil&type=Code - DLD -- David Lowry-Duda -- https://mail.python.org/mailman/listinfo/python-list