<story><title>Supply Chain Attack Using PyPI Packages “Colorslib”, “Httpslib”, and “Libhttps”</title><url>https://www.fortinet.com/blog/threat-research/supply-chain-attack-using-identical-pypi-packages-colorslib-httpslib-libhttps</url></story><parent_chain><item><author>woodruffw</author><text>I &lt;i&gt;really&lt;/i&gt; dislike this dilution of “zero-day” and “supply chain attack”: these are typosquats, not package takeovers. There’s no evidence that they’re widely affecting companies or individual developers whatsoever.&lt;p&gt;In general, you can apply a “repetition” test to these sorts of 0day claims: if the attacker can create infinite “0days” using the exact same technique, it’s not an 0day.&lt;p&gt;Edit: More generally, otherwise serious security companies should be ashamed to publish dreck like this. It’s one thing to highlight a tool that automatically detects new typosquats (this would be a genuinely useful contribution to most packaging ecosystems!); it’s another thing entirely to breathlessly hype non-existent attacks. This kind of false vigilance breeds &lt;i&gt;exactly&lt;/i&gt; the kind of complacency that it’s supposedly intended to prevent.</text></item></parent_chain><comment><author>tetha</author><text>Yeah. I&amp;#x27;ve been ranting about a similar thing in the context of jsonwebtoken to our security guy some days ago. The vulnerability pretty much goes &amp;quot;Well if I can inject an object with a toString() method of my choosing into your running program, then you&amp;#x27;re totally vulnerable&amp;quot;. Yeah, if you can inject and execute code.. you have achieved RCE? Kind of the whole pickle-discussion from python.&lt;p&gt;And nontheless, the assumed precondition for the vulnerability allows you to poison the key used to verify web tokens, so if you can inject data there, very big things immediately explode, like the entire authentication of the system collapsing.&lt;p&gt;But anyway, it&amp;#x27;s going round as a 7.6 with &amp;quot;trivial exploitation&amp;quot; in &amp;quot;JWTs&amp;quot; and OIDC uses those...  and now I have scared developers, and POs and customers calling and so on.&lt;p&gt;This makes it quite challenging and honestly somewhat exhausting to attempt to define a somewhat straightforward security process which doesn&amp;#x27;t cause alert fatigue very quickly.</text></comment>
<story><title>Supply Chain Attack Using PyPI Packages “Colorslib”, “Httpslib”, and “Libhttps”</title><url>https://www.fortinet.com/blog/threat-research/supply-chain-attack-using-identical-pypi-packages-colorslib-httpslib-libhttps</url></story><parent_chain><item><author>woodruffw</author><text>I &lt;i&gt;really&lt;/i&gt; dislike this dilution of “zero-day” and “supply chain attack”: these are typosquats, not package takeovers. There’s no evidence that they’re widely affecting companies or individual developers whatsoever.&lt;p&gt;In general, you can apply a “repetition” test to these sorts of 0day claims: if the attacker can create infinite “0days” using the exact same technique, it’s not an 0day.&lt;p&gt;Edit: More generally, otherwise serious security companies should be ashamed to publish dreck like this. It’s one thing to highlight a tool that automatically detects new typosquats (this would be a genuinely useful contribution to most packaging ecosystems!); it’s another thing entirely to breathlessly hype non-existent attacks. This kind of false vigilance breeds &lt;i&gt;exactly&lt;/i&gt; the kind of complacency that it’s supposedly intended to prevent.</text></item></parent_chain><comment><author>duxup</author><text>I know some folks in the security industry.   There is a crazy wide gap between capable security people and services and downright frauds.&lt;p&gt;To some extent that exists everywhere but at least say a developer who is terrible and can’t ship anything gets filtered out at some point.  Security land is absurd.&lt;p&gt;All the security people I know are very sensitive about it and have in many situations felt the need to &amp;#x2F; have quit a job after a fraud was hired.  They’re not dogmatic about security but they do care deeply about being productive and a sense that it’s their job to provide quality advice and actions.</text></comment>