pypi

10 Years of Meta’s Commitment to Python (opens in new tab)

Meta marks its 10th consecutive year sponsoring the Python Software Foundation (PSF), emphasizing that Python is central to its infrastructure, products, and AI work. The company views sponsorship as both a responsibility to the open-source community and a strategic investment in the long-term health, security, and innovation of the technology it relies on. ## Python’s Role at Meta - Python is Meta’s most widely used programming language. - It supports infrastructure for products including Instagram and Threads, as well as AI research and data-driven initiatives. - Meta engineers contribute directly to Python’s development, including core maintenance and Python Enhancement Proposals. - Meta’s open-source contributions include: - PyTorch, originally developed at Meta before becoming an independent foundation. - Pyrefly, a fast Python type checker and language server. - Meta expects Python to remain important as it expands AI capabilities and scales its infrastructure. ## Why Meta Supports the PSF - Open-source adoption creates a shared responsibility to maintain a healthy, secure, and sustainable ecosystem. - PSF funding supports the Developer-in-Residence program, enabling full-time developers to work on Python improvements that might otherwise be neglected or left to volunteers. - Sponsorship helps strengthen PyPI, including critical security improvements that protect package distribution and consumption. - Funding also supports education and community development through: - PyCon US workshops, summits, and discounted or free passes. - Fundraising and support for groups such as PyLadies. - Meta considers these efforts an investment in the tools, infrastructure, and people behind its own technology stack. ## Ways to Support the Python Software Foundation - Individuals can make one-time donations or become PSF members. - Membership may include voting rights and can be supported through financial contributions or volunteer time. - Organizations can become annual sponsors at different contribution levels. - Sponsorship offers public recognition, community engagement opportunities, event participation, and—in higher tiers—greater visibility and invitations to special initiatives. Meta concludes by thanking Python’s maintainers, contributors, educators, and advocates, while encouraging other individuals and organizations to help sustain the language through PSF donations, membership, or sponsorship.

Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting (opens in new tab)

GitLab researchers uncovered a coordinated PyPI supply-chain campaign distributing a copy of the Shai-Hulud worm. Five packages—four typosquats and one compromised legitimate project—execute malware during Python startup, steal credentials from CI/CD and cloud environments, and propagate through developers’ repositories and package registries. The campaign demonstrates that Python packages can be weaponized without imports or explicit function calls. ## Malicious PyPI Packages - All packages were published by the `elitexp` account: - `rlask` and `tlask`, typosquats of Flask - `rsquests`, a typosquat of Requests - `nhmpy`, a typosquat of NumPy - `mflux-streamlit`, a legitimate project later weaponized in versions `0.0.3` and `0.0.4` - The attacker first uploaded clean probe versions matching current upstream version numbers, then replaced them with payload-bearing releases. - The activity followed the public release of Shai-Hulud’s source code, suggesting an independent copycat operation targeting Python users. ## Python Startup-Based Infection - The malware uses Python `.pth` files, which Python processes automatically at startup. - The dropper: - Checks for a `.bun_ran` marker in the temporary directory. - Downloads the Bun JavaScript runtime from GitHub. - Executes a roughly 5 MB obfuscated JavaScript payload. - Early `rlask` versions also included `sitecustomize.py`, which searched `sys.path` for and executed a hidden `_index.js` file. - This approach requires no explicit package import or function invocation. ## Payload Obfuscation - The JavaScript is protected by multiple layers: - Package-specific ROT-N encoding - AES-128-GCM encryption - Variable-name mangling using `_0x` identifiers - Researchers identified: - A small encrypted Bun downloader - A 772 KB Shai-Hulud credential stealer - Approximately 2,538 hardcoded strings ## Credential Theft The worm targets credentials and secrets from: - GitHub Actions tokens, repository secrets, OIDC tokens, artifacts, and runner memory - AWS IAM credentials, instance metadata, Secrets Manager, SSM, and STS tokens - Azure managed identities, Key Vault, and Microsoft Graph tokens - GCP service-account keys and application credentials - HashiCorp Vault tokens and Kubernetes authentication - npm, JFrog, PyPI, and RubyGems publishing credentials - SSH private keys and Kubernetes service-account tokens - Sigstore credentials and Fulcio signing certificates - MongoDB, MySQL, PostgreSQL, and Redis connection strings ## Self-Propagation Using stolen credentials, the worm can: - Add `.github/setup.js` and workflow files to repositories so it runs in other CI pipelines. - Insert `.github/copilot-instructions.md` to influence AI coding assistants. - Publish poisoned packages to PyPI, npm, and RubyGems. - Attempt privilege escalation on self-hosted runners through `sudoers` modifications. - Detect StepSecurity’s harden-runner and alter its behavior. ## Attacker Infrastructure and Weaponized Project - The PyPI account was created in 2024 and was associated with the legitimate `mflux-streamlit` project. - Package uploads used `Bun/1.3.14`, matching the runtime downloaded by the malware. - Unlike a pure typosquatting campaign, the compromise of a real project could affect existing users through normal dependency updates. Developers should audit environments for the affected packages, review CI/CD and cloud credentials, rotate exposed secrets, and enforce dependency pinning and package provenance checks. CI runners and publishing tokens should be treated as potentially compromised if any affected version was installed.