I’ve lost a blog post / twitter thread, it was excellent and I cannot for the life of me find it. It was someone who installed every Python package (might not have been Python) and ended up getting completely pwned by malicious packages, found anime porn on their computer, all sorts. Help? 🙏 - ThreadSky

samwho.dev • 56 days ago

I’ve lost a blog post / twitter thread, it was excellent and I cannot for the life of me find it.

It was someone who installed every Python package (might not have been Python) and ended up getting completely pwned by malicious packages, found anime porn on their computer, all sorts.

Help? 🙏

Comments

travisnorthcutt.com•56 days ago

I *think* I've seen ppl mention using https://www.perplexity.ai/ to find blog posts etc.

but there's also some other vibes/description based search engine I just can't remember it at the moment

travisnorthcutt.com•56 days ago

ok I tried asking there, maybe this?

https://jordan-wright.com/blog/post/2020-11-12-hunting-for-malicious-packages-on-pypi/

perplexity search: https://www.perplexity.ai/search/ive-lost-a-blog-post-twitter-t-GS1RxKL2TCqZhAb6o7QPGQ

samwho.dev•56 days ago

Sadly not, but it’s close. The one I have in mind wasn’t a controlled research effort, it was a very YOLO experience.

samwho.dev•56 days ago

Tried it already :(

davemcpherson.dev•56 days ago

I know a while back someone made a package on npm called everything that included every package available in npm, as a side effect this meant that no one could unpublish their packages lol not sure if this is what you're referring to

https://www.bleepingcomputer.com/news/security/everything-blocks-devs-from-removing-their-own-npm-packages/

samwho.dev•56 days ago

Close!

https://bsky.app/profile/samwho.dev/post/3lekblh2mlc2f

davemcpherson.dev•56 days ago

This is wild, thanks for sharing!

akkartik.name•56 days ago

https://boehs.org/node/npm-everything

samwho.dev•56 days ago

Nah, not this one either. Close though.

akkartik.name•56 days ago

Whoa, I was so sure this was the one. How many times has someone attempted this?! 😂

samwho.dev•56 days ago

https://xkcd.com/242/

samwho.dev•56 days ago

I FOUND IT

https://moyix.blogspot.com/2022/09/someones-been-messing-with-my-subnormals.html?m=1

samwho.dev•56 days ago

> Unbeknownst to me, even with --dry-run pip will execute arbitrary code found in the package's https://setup.py. In fact, merely asking pip to download a package can execute arbitrary code

@sassnow.ski you will enjoy reading this.

samwho.dev•56 days ago

Also just in case @crmarsh.com hasn’t seen this, I suspect you’ll get a chuckle out of it.