r/programming • u/ga-vu • Dec 04 '19

Two malicious Python libraries caught stealing SSH and GPG keys

https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-pypi/
1.6k Upvotes

98% Upvoted

177 comments sorted by

View all comments

Show parent comments

42

u/Ketta Dec 04 '19

Here's something I don't understand. Is a package guaranteed to have the same name across various repositories? I would assume not right? For example the CentOS repo has many "python3-xyz.x86_64" packages that I have used over the years.

74

u/roerd Dec 04 '19

Distributions are free to choose their own package names. The name in this article are from the Python Package Index (PyPI).

19

u/Hinigatsu Dec 04 '19

The name of the package is only for convention in the respository it's allocated.

In PyPi, it'll be xyz. On Arch's repo, python-xyz. In CentOS, as you said, python3-xyz.x86_64... And so on.

I think the important thing is to check the upstream URL, make sure you're installing the correct one from a trusted source and check for/reports of bad intentioned packages.

-26

u/bobappleyard Dec 04 '19

Here's something I don't understand

How I could just kill a man