Security researchers at JFrog have discovered a simple technique for distributing malicious payloads via the PyPI package repository. The method involves re-registering malicious packages on PyPI using the names of legitimate packages that have been removed, allowing adversaries to pass off rogue packages as legitimate. This approach, called ‘Revival Hijack’, doesn’t rely on victims making mistakes and is an easy supply chain attack. JFrog’s investigations found 22,000 potentially vulnerable packages on PyPI. They recommend prohibition of the reuse of abandoned package names.
CDC issues warning over recalled eggs sold in three states
The Centers for Disease Control and Prevention (CDC) has issued a warning against recalled eggs linked to 24 hospitalizations due to salmonella infection. The eggs,
