Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

code execution backdoor #1

Open
di1l0o opened this issue Jun 29, 2022 · 0 comments
Open

code execution backdoor #1

di1l0o opened this issue Jun 29, 2022 · 0 comments

Comments

@di1l0o
Copy link

di1l0o commented Jun 29, 2022

We found a malicious backdoor in versions 0.0.1~0.0.2 of this project, and its malicious backdoor is the request package. Even if the request package was removed by pypi, many mirror sites did not completely delete this package, so it could still be installed.When using pip install PyCrowdTangle==0.0.2 -i http://pypi.doubanio.com/simple --trusted-host pypi.doubanio.com, the request malicious plugin can be successfully installed.

image

Repair suggestion: delete version 0.0.1~0.0.2 in PyPI

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant