Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

code execution backdoor #5

Closed
di1l0o opened this issue Mar 28, 2022 · 1 comment
Closed

code execution backdoor #5

di1l0o opened this issue Mar 28, 2022 · 1 comment
Assignees

Comments

@di1l0o
Copy link

di1l0o commented Mar 28, 2022

We found a malicious backdoor in versions 0.1~0.13 of this project, and its malicious backdoor is the request package. Even if the request package was removed by pypi, many mirror sites did not completely delete this package, so it could still be installed.When using pip3 install marcador==0.13 -i http://pypi.doubanio.com/simple --trusted-host pypi.doubanio.com, the request malicious plugin can be successfully installed.

image

Repair suggestion: delete version 0.1~0.13 in PyPI

@joajfreitas
Copy link
Owner

Just so I understand. You are using the http://pypi.doubanio.com/simple mirror when installing marcador. The malicious package is present in this mirror? Is it also present in the official pypi mirrors?

I see no problem in removing those versions from pypi just want to understand a bit better the thread model here :)

@joajfreitas joajfreitas self-assigned this Mar 28, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants