We're sorry but this page doesn't work properly without JavaScript enabled. Please enable it to continue.
Feedback

Pip install malware

Formal Metadata

Title
Pip install malware
Title of Series
Number of Parts
542
Author
Contributors
License
CC Attribution 2.0 Belgium:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Identifiers
Publisher
Release Date
Language

Content Metadata

Subject Area
Genre
Abstract
pip install malware: it’s that easy. Almost all projects depend on external packages, but did you know how easy it can be to install something nasty instead of the dependency you want? You might remember classic typosquatting examples like goggle.com, but it’s now common to see malicious code hidden in spoofed or otherwise fraudulent PyPI packages or nested dependencies. Malware developers can also use techniques like starjacking to appear legitimate, so these unpleasant packages become even more difficult to spot. It’s estimated that over 3% of packages on PyPI could be using this technique. By the end of this talk, you’ll know how to protect yourself when installing and updating dependencies and you’ll leave with a checklist to follow to help you stay safe in future.