Security researchers at JFrog have discovered a simple technique for distributing malicious payloads via the PyPI package repository. The method involves re-registering malicious packages on PyPI using the names of legitimate packages that have been removed, allowing adversaries to pass off rogue packages as legitimate. This approach, called ‘Revival Hijack’, doesn’t rely on victims making mistakes and is an easy supply chain attack. JFrog’s investigations found 22,000 potentially vulnerable packages on PyPI. They recommend prohibition of the reuse of abandoned package names.
The NCSC wants developers to get serious on software security
The NCSC’s new Software Security Code of Practice has been praised by cyber professionals as a significant advancement in enhancing software supply chain security.
