Two malicious Python libraries caught stealing SSH and GPG keys

The Python security team removed two trojanized Python libraries from PyPI (Python Package Index) that were caught stealing SSH and GPG keys from the projects of infected developers. The two libraries were created by the same developer and mimicked other more popular libraries -- using a technique called typosquatting to register similarly-looking names. The first is "python3-dateutil," which imit

[causeless]

"@k12u PythonのライブラリでSSH/GPG鍵を盗んでいるのが発見される 日本語でほとんど言及されてな…" via https://twitter.com/k12u/status/1202254981409017858

[nilab]

"The two libraries were created by the same developer and mimicked other more popular libraries" "technique called typosquatting" "The first is "python3-dateutil," which imitated the popular "dateutil" library. The second is "jeIlyfish" (the first L is an I), which mimicked the "jellyfish" library."

[Vorspiel]

jeIlyfish(je-uppercase i-lyfish)はイヤらしいな

[yujiorama]

python3-dateuil と jeIlyfish というライブラリ