0

I just learnt that in PyPi you can find malicious python packages. For example, you could install a package and in the setup.py there could be code that search for your ssh or aws keys and send them to the hacker during the installation phase. My question was if this kind of malicious behaviour can be detected and blocked by the antivirus.

Improve this question
1
  • Code that searches for files and sends them out is not virus activity. So, AV is not designed to look for that. "Malicious" and "virus" are not always the same things. And Antivirus is not a "protect me from all the things" technology.
    – schroeder ♦
    Dec 26, 2022 at 22:06

1 Answer 1

Reset to default
2

An antivirus could be made to detect that behavior (it's just a matter of creating a signature for that evil package). However, it is highly unlikely such malicious package will be detected by your antivirus. Not even if you explicitly ask it to scan the package.

Before using any code from an untrusted place (and since anyone can upload to PyPi, that should a priori be considered untrusted) you should at least read it (even if cursory) before using that library in your program.

Improve this answer
2
  • Ok, thank you for your answer. Isn't a bad practice to have the credentials for ssh in an easily accessible config file? It seems strange to me that the most of coders do this without worrying about it.
    – alepic
    Dec 29, 2022 at 16:17
  • @alepic that's a completely different question (you should probably open a new question), the real risk depends on the threat model. Also, it might not be so "easiily accessible" (e.g. the key is password protected). Although the actual answer for your question is probably just "most coders don't worry about security at all"
    – Ángel
    Jan 3 at 22:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .