Remix.run Logo
Num2words PyPI Package Compromised(stepsecurity.io)
21 points by varunsharma07 2 days ago | 6 comments
zahlman an hour ago | parent | next [-]

> The compromise was first identified through several concerning indicators:

> Missing Repository Tag: Unlike previous releases, version 0.5.15 was published to PyPI without a corresponding tag in the official GitHub repository at https://github.com/savoirfairelinux/num2words/tags

> Timing Discrepancy: The package appeared on PyPI without any associated commits or release activities in the source repository

> Community Alert: Security researcher @johnk3r quickly raised the alarm on social media, warning the community about potential compromise

This is one of the AI "tells" that I find especially strange. It doesn't just overuse these bullet-point lists; it puts things in the list that clearly don't belong.

The "community alert", of course, is not a "concerning indicator" that was used to identify the compromise.

But if you take that out, "several" is a strange way to describe "two", and the whole thing would clearly be better written as free-form prose.

vdupras 2 days ago | parent | prev | next [-]

What a blast from the past, I created that library, what more than a decade ago? How simpler the world was back then. This was used by nobody except us for our little shitty use case. How noisy this project has become!

arjvik 2 days ago | parent [-]

who currently has control over the package on PyPI? wondering how it was compromised

tardyp 2 days ago | parent | next [-]

New maintainers never bothered to change the range.. History num2words is based on an old library, pynum2word, created by Taro Ogawa in 2003. Unfortunately, the library stopped being maintained and the author can't be reached. There was another developer, Marius Grigaitis, who in 2011 added Lithuanian support, but didn't take over maintenance of the project.

I am thus basing myself on Marius Grigaitis' improvements and re-publishing pynum2word as num2words.

Virgil Dupras, Savoir-faire Linux

vdupras 2 days ago | parent | prev [-]

I have no idea, it hasn't been me for years.

varunsharma07 2 days ago | parent | prev [-]

Popular Python Package num2words v0.5.15 Published Without Repository Tag, Linked to Known Threat Actor