<story><title>Cybercriminals pose as &quot;helpful&quot; Stack Overflow users to push malware</title><url>https://www.bleepingcomputer.com/news/security/cybercriminals-pose-as-helpful-stack-overflow-users-to-push-malware/</url></story><parent_chain><item><author>bheadmaster</author><text>The root of the problem is allowing pip to execute arbitrary code when installing a package from PyPI (default package index), combined with the complete lack of vetting of PyPI packages. Even something as simple as mistyping a package name can cause malicious code to be executed on your computer.&lt;p&gt;Installing packages (i.e. source code) for programming languages should not execute arbitrary code.</text></item></parent_chain><comment><author>yeputons</author><text>Does installation matter at all? Once you&amp;#x27;ve installed a package, you&amp;#x27;re very likely to immediately include it in the project, build, and run. Any malicious code can easily run during the package&amp;#x27;s initialization in your app.&lt;p&gt;Seems like prohibiting arbitrary code in installation scripts would only help with issues like Bumblebee&amp;#x27;s `rm -rf`: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;MrMEEE&amp;#x2F;bumblebee-Old-and-abbandoned&amp;#x2F;issues&amp;#x2F;123&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;MrMEEE&amp;#x2F;bumblebee-Old-and-abbandoned&amp;#x2F;issue...&lt;/a&gt;</text></comment>
<story><title>Cybercriminals pose as &quot;helpful&quot; Stack Overflow users to push malware</title><url>https://www.bleepingcomputer.com/news/security/cybercriminals-pose-as-helpful-stack-overflow-users-to-push-malware/</url></story><parent_chain><item><author>bheadmaster</author><text>The root of the problem is allowing pip to execute arbitrary code when installing a package from PyPI (default package index), combined with the complete lack of vetting of PyPI packages. Even something as simple as mistyping a package name can cause malicious code to be executed on your computer.&lt;p&gt;Installing packages (i.e. source code) for programming languages should not execute arbitrary code.</text></item></parent_chain><comment><author>mrspuratic</author><text>&amp;quot;curl ... | bash&amp;quot; makes me run away from a project.&lt;p&gt;There is the reductive argument that basically everything you download is arbitrary code, but throwing away the code that is run seems uniquely silly.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=21490151&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=21490151&lt;/a&gt;</text></comment>