Warning: PyPI Feature Executes Code Automatically After Python Package Download,
In another finding that could expose developers to increased risk of a supply chain attack, it has emerged that nearly one-third of the packages in PyPI, the Python Package Index, trigger automatic code execution upon downloading them.
« A worrying feature in pip/PyPI allows code to automatically run when developers are merely downloading a package, » Checkmarx researcher Yehuda Gelb said in a
« A worrying feature in pip/PyPI allows code to automatically run when developers are merely downloading a package, » Checkmarx researcher Yehuda Gelb said in a
,
In another finding that could expose developers to increased risk of a supply chain attack, it has emerged that nearly one-third of the packages in PyPI, the Python Package Index, trigger automatic code execution upon downloading them.
« A worrying feature in pip/PyPI allows code to automatically run when developers are merely downloading a package, » Checkmarx researcher Yehuda Gelb said in a
« A worrying feature in pip/PyPI allows code to automatically run when developers are merely downloading a package, » Checkmarx researcher Yehuda Gelb said in a
, ,
https://thehackernews.com/2022/09/warning-pypi-feature-executes-code.html