Sean R. Lynch ☑️ is a user on literati.org. You can follow them or interact with them if you have an account anywhere in the fediverse.
If you don't, you can sign up here.
holy shit.
https://www.reddit.com/r/Python/comments/8hvzja/backdoor_in_sshdecorator_package/
https://twitter.com/x0rz/status/994116668086542336
"The ssh-decorator package from Python pip had an obvious backdoor"
sends host + username + password to an external website
@nightpool Chapter four billion, seven hundred thirty-eight thousand, nine hundred twenty-four in why you shouldn't blindly install stuff from a package system anyone can upload to.
@nightpool Or even with your eyes open, since at any time a package could change hands.