Aggregator

Malicious Python Packages and Code Execution via pip download

Embrace The Red
3 years 7 months ago

This week I learned about a design flaw with pip download, which allows an adversary to run arbitrary code.

I assumed that running pip install means anything could happen, but pip download seems a bit surprising.

Both seem useful for red teaming though.

Background

This post from Yehuda Gelb named Automatic Execution of Code Upon Package Download on Python Package Manager which the Security Now! podcast pointed me towards.

The post highlights that just running pip download can compromise your computer.

Managed ad