How Spam Official Python Package Repository?

The official Python software package repository, PyPI, is getting flooded with spam packages, as seen by BleepingComputer. These packages are named after different movies in a style that is commonly associated with torrents and ‘warez’ sites hosting pirated content.

What are the best tools for package management in Python?

Package management in Python is available through a variety of different tools: Pip remains one of the most popular choices because it virtually eliminates manual installs and updates of software packages to operating systems.

How do I install a Python package in a virtual environment?

Install virtualenv if it’s not already installed: Create a new directory which will be used to hold Python packages as well as files used by Apache. Create a new virtual environment called venv inside this directory, then activate: Download the package through pip in the newly created virtual environment:

Official Python software package repository flooded with spam

  1. Home
  2. News
  3. Computing
  • (Photo courtesy of Kevin Ku / Pexels.) An attack against the official Python software package repository PyPI has been launched by threat actors, who have begun flooding the repository with spam packages, according to a recent report published by BleepingComputer. As with torrents and other pirated content online, these spam packages use a naming style that is commonly associated with torrents and other pirated content online, in which the title of a movie, the current year, as well as the words online and free are included in the package’s name, such as ″watch army of the dead 2021 full online movie free hd quality.″ A list of the finest endpoint protection software has been compiled
  • these are the best laptops for developers now available on the market
  • Take a look at our overview of the finest firewalls as well.

After discovering a PyPI component that was named after an episode of a famous television show, senior software engineer at Sonatype, Adam Boesch, began investigating the suspicious packages.In an interview with BleepingComputer, Boesch gave further insight on his finding, saying: ″I was searching through the dataset and spotted ‘wandavision,’ which is a bit unusual for a package name.″ I discovered that package after digging a little more and looking it up on PyPI since I couldn’t believe it.It’s not unusual in other ecosystems, such as npm, where there are hundreds of thousands of packages.″Fortunately, packages like this are quite straightforward to identify and avoid.″

Spam packages

In addition to spam keywords and connections to illicit video streaming websites, the spam packages identified on PyPI contain files with functional code and author information that have been taken from legitimate Python software packages, according to the spammers.Upon further investigation, the news outlet discovered that the spam package contained author information as well as code from the PyPI package ″jedi-language-server.″ When BleepingComputer discovered a spam package titled ″watch-army-of-the-dead-2021″ and investigated it, it discovered that it contained author information as well as code from the PyPI package ″jedi-language-server.″ While numerous similar-named packages used to be simple to locate on PyPI by searching for ″full-online-movie-free,″ it looks that the maintainers of the Python Package Index repository have cleaned up the most of the spam at the time of writing.The use of any of these spam packages should be avoided at all costs by Python developers searching for new packages in the repository.These spam packages are likely to include malware or other dangerous code, and they should be avoided at all costs.

  1. We’ve also included the finest antivirus software.

In addition to spam keywords and connections to illicit video streaming websites, the spam packages identified on PyPI contain files with functional code and author information that have been taken from legitimate Python software packages, according to the PyPI.As a result of its investigation, the news outlet discovered that the spam package titled ″watch-army-of-the-dead-2021-full-online-movie-free-hd-quality″ contained author information as well as code from the ″jedi-language-server″ PyPI package, which was discovered by BleepingComputer and investigated by the FBI.While numerous packages with identical names used to be simple to locate on PyPI by searching for ″full-online-movie-free,″ it looks that the maintainers of the Python Package Index repository have cleaned up the most of the spam at the time of writing.The use of any of these spam packages should be avoided at all costs by Python developers searching for new packages in the repository.

  1. These spam packages are likely to include malware or other dangerous code, and should be avoided at all costs.
  2. The top antivirus software has also been highlighted.

How Spam Flooded the Official Python Software Package Repository PyPI

This is the story of how spam inundated the official Python Software Package Repository.PyPI It has been reported that ″the official Python software package repository, PyPI, is being inundated with spam packages…″ According to Bleeping Computer on Thursday.Since each of these packages is submitted by a distinct pseudonymous maintainer account, PyPI will find it tough to delete all of the packages and spam maintainer accounts at the same time…″ PyPI is being inundated with spam packages named after popular movies in a way that is often associated with torrent or ″warez″ sites that promote unauthorized downloads, such as the following examples: watch-(movie-name)-2021-full-online-movie-free-hd-… BleepingComputer discovered that spammers are continuing to add fresh packages to the Python Package Index (PyPI), even though some of these packages are only a few of weeks old.In addition to spam keywords and connections to movie streaming services, the web page for these fake bundles contains links to websites of dubious validity and legality…

  1. According to ZDNet, in February of this year, the keygen repository PyPI was inundated with fraudulent ″Discord,″ ″Google,″ and ″Roblox″ keygens as part of a large spam assault.
  2. Since then, Ewa Jodlowska, Executive Director of the Python Software Foundation, has stated that administrators at pypi.org are working on mitigating the spam assault; but, due to the nature of the repository itself, anybody may publish to it and similar incidents are regular.
  3. These packages, in addition to containing spam keywords and links to quasi-video streaming websites, also contain files containing functional code and author information that have been taken from valid PyPI packages….

Malicious actors have mixed code from valid packages with otherwise fraudulent or malicious programs, as previously discovered by BleepingComputer, in order to conceal their tracks and make identification of these packages a little more difficult.The number of assaults against open-source ecosystems such as npm, RubyGems, and PyPI has increased significantly in recent months.Several instances of threat actors flooding software repositories with malware, harmful dependency confusion copycats, or just vigilante packages in order to promote their message have been documented.As a result, the security of these repositories has devolved into a game of whack-a-mole between threat actors and repository administrators.

  • Originally published on SecuritNEWS, the article How Spam Infested the Official Python Software Package Repository PyPI appeared first.

Official Python software package repository flooded with spam

An attack against the official Python software package repository PyPI has been launched by threat actors, who have begun flooding the repository with spam packages, according to a recent report published by BleepingComputer.As with torrents and other pirated content online, these spam packages use a naming style that is commonly associated with torrents and other pirated content online, in which the title of a movie, the current year, as well as the words online and free are included in the package’s name, such as ″watch army of the dead 2021 full online movie free hd quality.″ After discovering a PyPI component that was named after an episode of a famous television show, senior software engineer at Sonatype, Adam Boesch, began investigating the suspicious packages.In an interview with BleepingComputer, Boesch gave further insight on his finding, saying, ″I was searching through the dataset and spotted ‘wandavision,’ which is a bit unusual for a package name.″ I discovered that package after digging a little more and looking it up on PyPI since I couldn’t believe it.It’s not unusual in other ecosystems, such as npm, where there are hundreds of thousands of packages.

  1. ″Fortunately, packages like this are quite straightforward to identify and avoid.″

Spam packages

In addition to spam keywords and connections to illicit video streaming websites, the spam packages identified on PyPI contain files with functional code and author information that have been taken from legitimate Python software packages, according to the spammers.Upon further investigation, the news outlet discovered that the spam package contained author information as well as code from the PyPI package ″jedi-language-server.″ When BleepingComputer discovered a spam package titled ″watch-army-of-the-dead-2021″ and investigated it, it discovered that it contained author information as well as code from the PyPI package ″jedi-language-server.″ While numerous similar-named packages used to be simple to locate on PyPI by searching for ″full-online-movie-free,″ it looks that the maintainers of the Python Package Index repository have cleaned up the most of the spam at the time of writing.The use of any of these spam packages should be avoided at all costs by Python developers searching for new packages in the repository.These spam packages are likely to include malware or other dangerous code, and they should be avoided at all costs.

  1. According to BleepingComputer

Official Python software package repository flooded with spam

  1. Home
  2. News
  3. Computing
  • (Photo courtesy of Kevin Ku / Pexels.) An attack against the official Python software package repository PyPI has been launched by threat actors, who have begun flooding the repository with spam packages, according to a recent report published by BleepingComputer. As with torrents and other pirated content online, these spam packages use a naming style that is commonly associated with torrents and other pirated content online, in which the title of a movie, the current year, as well as the words online and free are included in the package’s name, such as ″watch army of the dead 2021 full online movie free hd quality.″ A list of the finest endpoint protection software has been compiled
  • these are the best laptops for developers now available on the market
  • Take a look at our overview of the finest firewalls as well.

After discovering a PyPI component that was named after an episode of a famous television show, senior software engineer at Sonatype, Adam Boesch, began investigating the suspicious packages.In an interview with BleepingComputer, Boesch gave further insight on his finding, saying: ″I was searching through the dataset and spotted ‘wandavision,’ which is a bit unusual for a package name.″ I discovered that package after digging a little more and looking it up on PyPI since I couldn’t believe it.It’s not unusual in other ecosystems, such as npm, where there are hundreds of thousands of packages.″Fortunately, packages like this are quite straightforward to identify and avoid.″

Spam packages

In addition to spam keywords and connections to illicit video streaming websites, the spam packages identified on PyPI contain files with functional code and author information that have been taken from legitimate Python software packages, according to the spammers.Upon further investigation, the news outlet discovered that the spam package contained author information as well as code from the PyPI package ″jedi-language-server.″ When BleepingComputer discovered a spam package titled ″watch-army-of-the-dead-2021″ and investigated it, it discovered that it contained author information as well as code from the PyPI package ″jedi-language-server.″ While numerous similar-named packages used to be simple to locate on PyPI by searching for ″full-online-movie-free,″ it looks that the maintainers of the Python Package Index repository have cleaned up the most of the spam at the time of writing.The use of any of these spam packages should be avoided at all costs by Python developers searching for new packages in the repository.These spam packages are likely to include malware or other dangerous code, and they should be avoided at all costs.

  1. We’ve also included the finest antivirus software.
See also:  Why Is Fedex Not Delivering My Package?

According to BleepingComputer After getting his start at ITProPortal while residing in South Korea, Anthony is now a contributing writer for TechRadar Pro, where he covers topics such as cybersecurity, web hosting, cloud computing, virtual private networks, and software.In addition to writing the news, he edits and uploads reviews and features, and he tests a large number of VPNs from his home in Houston, Texas, where he lives.Anthony has recently taken a closer look at standing desks, office chairs, and a variety of other work-from-home needs, among other things.When he’s not working, you’ll find him playing with computers and video gaming consoles, managing wires, and improving his smart home technology.

Spammers flood PyPI with pirated movie links and bogus packages

According to the website BleepingComputer, the official Python software package repository, PyPI, is being inundated with spam package submissions.In a manner that is typically associated with torrents and ″warez″ sites that contain unauthorized content, these packages are named after different movies.The fact that each of these packages is released by a different pseudonymous maintainer account makes it difficult for PyPI to delete all of the packages and spam accounts at the same time.

PyPI is being flooded with spam packages

PyPI is being inundated with spam packages named after popular movies in a way that is often associated with torrent or ″warez″ sites that promote unauthorized downloads, such as the following examples: watch-(movie-name)-2021-full-online-movie-free-hd-.The finding was made by Adam Boesch, a senior software developer at Sonatype, when auditing a dataset and seeing a PyPI component with a funny-sounding name that was named after a famous television show.″I was searching through the dataset when I came across the package name ‘wandavision,’ which I thought was a little unusual for a package name.″ ″After digging a little more, I discovered that package and checked it up on PyPI because I couldn’t believe it,″ Boesch explained in an interview with BleepingComputer.Despite the fact that some of these packages are a few weeks old, BleepingComputer has discovered that spammers are continuing to submit more packages to PyPI, with the most recent addition occurring only an hour before publication.

  1. According to our findings, the search result count of ″10,000+″ may be inflated, since the real number of spam packages being displayed on the PyPI repository was far lower.
  2. The web page for these phony packages contains spam keywords and links to movie streaming sites, some of which are of doubtful validity and legality, such as the ones listed below: The following is an example of one of the several packages that were posted around an hour ago, at the time of writing: In addition, BleepingComputer discovered that each of these packages was published by a separate author (maintainer) account that used a pseudonym, which is likely to make it difficult for PyPI administrators to remove these packages.
  3. PyPI has been inundated with fraudulent ″Discord,″ ″Google,″ and ″Roblox″ keygens in a large spam assault in February of this year, according to ZDNet, which covered the incident.

Since then, Ewa Jodlowska, Executive Director of the Python Software Foundation, has stated that administrators at pypi.org are working on mitigating the spam assault; but, due to the nature of the repository itself, anybody may publish to it and similar incidents are regular.

Packages contain code from legitimate PyPI components

These packages, in addition to containing spam keywords and links to pseudo-video streaming websites, also contain files containing functional code and author information that have been copied from legitimate PyPI packages.Examples include the spam package ″watch-army-of-the-dead-2021-full online movie free hd quality,″ which featured author information as well as code from the legal PyPI package ″jedi-language-server,″ which was discovered by BleepingComputer.BleepingComputer has previously revealed that malicious actors have mixed code from genuine packages with otherwise fraudulent or malicious packages in order to disguise their tracks and make identification of these packages a little more difficult.″It’s not unusual in other ecosystems, such as npm, where there are hundreds of thousands of packages.

  1. Fortunately, these types of packages are quite straightforward to identify and avoid.″ ″Preparing for the use of any package should always be done with caution.
  2. If something doesn’t seem quite right, there’s probably a good explanation for it ″Boesch cracked a grin.
  3. The number of assaults against open-source ecosystems such as npm, RubyGems, and PyPI has increased significantly in recent months.

Several instances of threat actors flooding software repositories with malware, harmful dependency confusion copycats, or just vigilante packages in order to promote their message have been documented.As a result, the security of these repositories has devolved into a game of whack-a-mole between threat actors and repository administrators.Before posting this article, BleepingComputer contacted out to PyPI for comment, and we are still awaiting their answer.

Ax Sharma

Ax Sharma works as a security researcher, engineer, and columnist for many technology publications.Several notable media publications, including Fortune, The Register, TechRepublic, CIO, and others, have covered his work and expert insights on a regular basis.Victim research, reverse engineering, software development, and online application security are some of Ax’s areas of specialization.He is a contributing member of the OWASP Foundation, OpenSSF, and the British Association of Journalists, among other organizations (BAJ).

  1. Send any suggestions to [email protected] or [twitter DM].

r/programming – Official Python software package repository flooded with spam

An uneasy part of me wonders whether this was really an elaborate diversion from something more terrible.For example, why go to the trouble of compiling a slew of spam, identifying a vulnerability, developing an exploit, and delivering a payload that.pushes ″packages″ with obviously spammy names that draw attention to themselves to the repository, but only contains code that already exists within the repository.Something doesn’t smell right here.

  1. It’s possible that there’s more going on than we’re currently aware of.
  2. Hopefully, they have backups that they can restore in the event that something other than ″watch-movie-free″ was accidentally uploaded into their server throughout the process.
  3. Obviously, I can’t say for certain.

However, in most cases, there are significant benefits to be gained via hacking: financial gain, information exfiltration, or some other benefit that makes all of the difficulties worthwhile.Or, if not, the target is a social or political target that is being targeted in order to make a statement (which does not appear to be the case here).However, the fact that the hacker stands to gain nothing in terms of money or information, the fact that there is no genuine political or social motivation behind this, and the fact that all of the identities make it clear that it is spam, all lead me to believe that this is a spam campaign.This is a strange case, to say the least.

PyPI, GitLab dealing with spam attacks

Thousands of spammers have flooded both the Python Package Index (PyPI) portal and the GitLab source code hosting website with junk material, filling both with advertisements for dubious websites and services. The assaults were completely unconnected to one another.

PyPI flooded with more than 10,000 listings

The most significant of the two attacks targeted PyPI, the official package repository for the Python programming language, as well as a website that holds tens of thousands of Python libraries, according to the FBI.Since last month, spammers have taken advantage of the fact that anybody may make entries on the PyPI website in order to produce pages for non-existent Python libraries, which in turn have acted as gigantic search engine optimization advertisements for a variety of questionable websites.According to ZDNet’s tests, the pages typically contained a soup of search-engine-friendly keywords for a variety of topics, ranging from gaming to porn and from movie streaming to giveaways, as well as a shortened link at the bottom, which often directed to a site attempting to obtain payment card information.After being contacted for a comment earlier today, the PyPI team stated that it was aware of the SEO spam on the site.

  1. Ewa Jodlowska, Executive Director of the Python Software Foundation, wrote in an email to ZDNet on Monday that ″our admins are trying to resolve the spam.″ ″Because of the nature of pypi.org, anyone may submit to it, making it a reasonably frequent place to get content,″ she continued.
  2. A short time after the exec’s email was sent, many of the spam listings that had been established on the PyPI site began to be deleted, a process that looks to be continuing at this time.

GitLab project owners spammed via email

The spam campaign on Python has been ongoing for at least a month, but a fresh one has been discovered at GitLab, a platform that allows developers and businesses to store and sync work on source code repositories.On Sunday and Monday, an unknown threat actor appears to have inundated the Issues Tracker for thousands of GitLab projects with spam content, which in turn prompted an email to account holders for each project affected.Users were routed to unscrupulous websites in these comments, just as they were in the spam on PyPI.It appears that spam organizations are now targeting source code repositories, as opposed to past years when they mostly targeted blogs, forums, and news portals, which were frequently inundated with dodgy links in their comment areas, which was a common practice.

  1. According to a business incident status report issued on Monday, GitLab was clearly unprepared for this type of assault since its email system was swamped and slowed down, with valid emails being delayed and queued as a result.
  2. The situation has again returned to normal, but both examples demonstrate the perils of keeping computers exposed and vulnerable on the internet.
  3. While spam is not a very exciting attack vector, many businesses fail to safeguard their servers, web applications, and subdomains, and as a result, these resources are frequently misused to either host or participate in spam assaults.

In the case of Microsoft, one year later, the company is still dealing with spam organizations hijacking subdomains on its official microsoft.com website in order to post questionable content.

Official Python software package repository flooded with spam

Several reports from BleepingComputer indicate that the official Python application package repository PyPI is under attack from threat actors who have begun flooding the repository with spam packages.This type of spam uses a naming design that is commonly associated with torrents and other pirated content on the internet, where every single package’s name is made up of the title of a film, the year it was released, and the terms on the internet and free of charge, such as ″watch-army-of the-lifeless-2021-comprehensive-on-the-internet film-free of charge″ and ″army of the lifeless-2021-comprehensive-on-the-inter ″I was going through the dataset when I came across the word ‘wandavision,’ which I thought was a little strange for a package name.Searching a little closer, I discovered that package and looked it up on PyPI, mostly because I did not trust it.It’s not unusual in other ecosystems, such as npm, where there are hundreds of thousands of packages.

  1. Offers like this, fortunately for us, are quite easy to identify and avoid.″
See also:  What Is The Highest Zip Code?

Spam packages

Furthermore, in addition to including spam keyword terms and links to illegal movie streaming websites, the spam packages found on PyPI contain files with important code and writer data that have been stolen from real Python software packages.Following investigating a spam package titled ″watch-army-of-the-dead-2021 comprehensive on the internet film-free-high definition-quality″ and discovering that it contained writer data as well as some code from the ″jedi-language-server″ PyPI package, BleepingComputer published a report on the findings on its website.Although a search for ″full-on the internet-film-free″ on PyPI previously yielded a large number of similarly named packages, it appears that the maintainers of the Python Offer Index repository have cleaned out the most of the spam as of the time of writing.Developers using Python to search for new packages in the repository, however, must be extremely cautious when downloading and opening any of these spam packages since they may include malware or other dangerous code.

  1. By making use of BleepingComputer

PyPI Repository Flooded With Spam Packages and Pirated Movie Links

Furthermore, in addition to including spam keyword terms and links to illegal movie streaming websites, the spam packages hosted on PyPI contain files with important code and writer data that have been stolen from real Python software packages.Following investigating a spam package titled ″watch-army-of-the-dead-2021 comprehensive on the internet film-free-high definition-quality″ and discovering that it contained writer data as well as some code from the ″jedi-language-server″ PyPI package, BleepingComputer published a report on the findings on their website.Although a search for ″full-on the internet-film-free″ on PyPI previously yielded a plethora of similarly titled packages, it appears that the maintainers of the Python Offer Index repository have cleaned out the most of the spam as of the time of this publication.Python developers looking for new packages in the repository, on the other hand, should proceed with caution if they decide to download and open any of these spam packages, since they may include malware or other hazardous code.

  1. In order to make use of BleepingComputer,

spams

The Python module that interfaces with the SPAMS C++ library is available here.

What is SPAMS?

  • SPArse Modeling Software (SPArse Modeling Software) is an optimization toolbox that may be used to solve a variety of sparse estimation issues. The use of dictionary learning and matrix factorization (NMF, sparse PCA, and so forth)
  • The use of sparse decomposition methods such as LARS, coordinate descent, OMP, SOMP, and proximal approaches to solve issues
  • Structured sparse decomposition issues (l1/l2, l1/linf, sparse group lasso, tree-structured regularization, structured sparsity with overlapping groups, etc.) are solved using structured sparsity.

Installation

Requirements

  • A current C++ compiler (tested with gcc >= 4.5)
  • a BLAS/LAPACK library (such as OpenBLAS, Intel MKL, or Atlas)
  • and a modern C++ runtime environment.

Installing libblas and liblapack should be done with care.On Ubuntu, for example, it is essential to run sudo apt-get -y install libblas-dev liblapack-dev gfortran before the compiler can be installed.You will most likely need to run brew install gcc openblas lapack on a Macintosh computer.It is recommended that you install the MKL Intel library first (which can be found on PyPI with pip install mkl, or in the Anaconda Python distribution with conda install mkl) before installing Numpy.

  1. This will result in improved performance (which is a dependency of SPAMS, the latter checking Numpy configuration for its installation).
  2. SPAMS for Python has been thoroughly tested on both Linux and MacOS.
  3. At the time, it is not available for Windows users.

For MacOS users, the installation process checks to see if OpenMP is present on your system and then decides whether or not to activate or disable OpenMP support.We recommend that you install an OpenMP-compatible compiler on your system in order to get better performance (e.g.gcc or llvm).Note for Windows users: For the time being, you may install spams-bin using pip install spams-bin (which is given by

Installation from PyPI:

The following libraries are utilized by Numpy in the typical installation: BLAS and LAPACK. pip install generates a lot of spam.

Installation from sources

Check to check that libblas and liblapack have been installed (see above) git clonecd spams-python pip install -e spams-python pip install -e

Usage

Numpy and scipy are used to import objects that have been modified. Matrices should be stored as columns, and sparse matrices should be ″column compressed″ in order to save storage space.

Testing the interface

For use from the command line (which should be invoked from the project root directory):

Tests/test spams.py -hprint the man page of the Python script python tests/test spams.py is a Python script. carry out all of the tests Following is an example of Python code (assuming the spams package is installed):

Tests/test spams.py -hprint the man page of the Python code tests/test spams.py in the Python programming language All tests should be executed. If the spams package is installed, the following may be done in Python:

Refer to the preceding paragraph for further information on the various alternatives. ″from spams.tests import test spams; test spams()″ python -c ″from spams.tests import test spams; test spams()″

Links

  • Official website (with documentation and downloads)
  • Python-specific project and PyPI repository (available with pip install spams)
  • Python-specific project and PyPI repository (available with pip install spams)
  • Remotes:install github(″getspams/spams-R″) may be used to access the R specific project.
  • C++ project from the ground up (as well as the original sources for the interfaces to Matlab, Python, and R)

A number of SPAMS-related git repositories are also accessible on the Inria gitlab forge, including the following: See the original C++ project (as well as the original sources for the Matlab, Python, and R interfaces), the Python specific project, and the original C++ project.

Contact

  • Concerning the SPAMS Python package, you may file a bug report on the dedicated git repository at https://github.com/spamspython/issues/new. When it comes to the SPAMS R package, you may file a bug report on the corresponding git project, which can be found here. If you have any more questions about the use or development of SPAMS, you may contact us at spams.dev’AT’inria.fr (replace ‘AT’ with @)
  • you can start an issue on the general git project at
  • or you can post a comment on this blog post.

Authorship

Sparse estimate techniques developed and maintained by Julien Mairal (Inria) are included in SPAMS, which was created through partnerships with a number of individuals including Francis Bach, Jean Ponce, Guillermo Sapira, Rodolphe Jenatton, and Guillaume Obozinski.It is written in C++ and has a Matlab interface.Jean-Paul Chieze has created interfaces for R and Python, and Yuansi Chen has authored a paper on archetypal analysis, all of which are available online.Ghislain Durif was responsible for the release of version 2.6/2.6.1 as well as the porting to R-3.x and Python3.x (Inria).

  1. The initial conversion to Python3.x was based on this patch as well as on the work of John Kirkham, which may be found at this location.
  2. Francois Rheault and Samuel Saint-Jean contributed to the development of version 2.6.2 (which is only available in Python).

Maintenance

  • Because SPAMS (particularly the Python version) is currently maintained by a team consisting of Alessandro Daducci, Ghislain Durif, Francois Rheault, Samuel Saint-Jean, and others, it has been upgraded to version 2.6.3 or above.

Funding

The SIERRA and VIDEOWORLD ERC projects, as well as the MACARON ANR project, provided funding for a portion of this research.

License

The SIERRA and VIDEOWORLD ERC projects, as well as the MACARON ANR project, provided funding for a portion of this study.

News

  • Python SPAMS is now officially hosted on Github as of February 14, 2022.
  • SPAMS C++ project and SPAMS for R project are now officially hosted on Github as of July 2, 2022
  • Python SPAMS v2.6.3 is released (source and PyPI)
  • Python SPAMS v2.6.2 is released (source and PyPI)
  • Python SPAMS v2.6.1 is available on PyPI
  • Python SPAMS v2.6.2 is available on PyPI
  • Python SPAMS v2.6.1 is available on PyPI
  • Python SPAMS v2.6.2 is available on PyPI
  • Python SPAMS v2.6.1 is available on PyPI
  • Python SPAMS v2.6.1 is available on PyPI
  • Python SPAMS v
  • Release of Python SPAMS v2.6.1 for Anaconda (with MKL support) on the 8th of December, 2017.
  • Python SPAMS v2.6.1 (a single source code for Python 3 and 2) is published on the 24th of August, 2017.
  • SPAMS v2.6 is published on February 27th, 2017, and includes precompiled Matlab packages, R-3.x and Python3.x compatibility, among other features.
  • SPAMS v2.5 is released on May 25, 2014
  • SPAMS v2.4 is released on December 5, 2013
  • SPAMS v2.3 is released on May 23, 2012
  • SPAMS v2.2 is released on March 24, 2012, with a Python and R interface, as well as new compilation scripts for improved Windows/Mac OS compatibility
  • SPAMS v2.3 is released on May 23, 2012
  • SPAMS v2.3 is released on March 24, 2012
  • SPAMS v2.2 is released on March 24, 2012, with a Python and
  • 30th of June, 2011: SPAMS v2.1 is made available as open-source software
  • Spams v2.0 is now available for Linux and Mac OS X
  • the Windows 32-bit version was released on February 23rd, 2010. The Elastic-Net protocol is implemented.
  • On October 26, 2009, a Mac OS X 64-bit version became released.

References

A monograph about sparse estimation

We strongly advise users of SPAMS to read the accompanying book, which provides various applications of dictionary learning, an introduction to sparse modeling, and numerous practical recommendations for the software.J.Mairal, F.Bach, and J.

  1. Ponce are among those who have contributed to this work.
  2. For image and Visio processing, Sparse Modeling is used.
  3. Vol.

8, no.2-3, pages 85-283 in Foundations and Trends in Computer Graphics and Vision (2014).

Related publications

  • You may discover some of the original writings that influenced the development of this program here. A number of articles in which the ″matrix factorization″ and ″sparse decomposition″ modules were created include the following: J. Mairal, F. Bach, J. Ponce, and G. Sapiro are among those who have contributed to this work. Matrix Factorization and Sparse Coding are two topics that may be learned online. The Journal of Machine Learning Research, number 11, pages 19-60, is a peer-reviewed journal dedicated to machine learning research. J. Mairal, F. Bach, J. Ponce, and G. Sapiro published a paper in 2010 titled Sparse Coding may be learned online using a dictionary. In 2009, the International Conference on Machine Learning was held in Montreal, Canada.
  • In the following articles, the ″proximal″ module was developed: J. Mairal (first author), R. Jenatton (second author), G. Obozinski (second author), and F. Bach (third author). Network Flow Algorithms for Structured Sparsity is a research paper published in the journal Network Flow. NIPS 2010
  • R. Jenatton, J. Mairal, G. Obozinski, and F. Bach. Advances in Neural Information Processing Systems (NIPS). 2010
  • R. Jenatton, J. Mairal, G. Obozinski, and F. Bach. Proximal Methods for Sparse Hierarchical Dictionary Learning are described in this paper. The International Conference on Machine Learning (ICML) was held in 2010
See also:  How Many Tablespoons In A 1 Oz Package Of Ranch Dressing Mix?

It was for the paper by J. Mairal and B. Yu, Supervised Feature Selection in Graphs with Path Coding Penalties and Network Flows, that the feature selection tools for graphs were created. JMLR published a report in 2013 titled

  • Incremental and stochastic proximal gradient algorithms were developed in accordance with the following papers: Stochastic Majorization-Minimization Algorithms for Large-Scale Optimization, J. Mairal, et al., in press. National Institute of Informatics and Systems (NIPS) 2013
  • J. Mairal, Optimization using First-Order Surrogate Functions, International Conference on Machine Learning (ICML) 2013

6 official Python repositories plagued with cryptomining malware

Researchers from the security firm Sonatype discovered six malicious typosquatting packages in the official Python programming language’s PyPI repository that were riddled with cryptomining malware, according to the company.Sonatype is a software supply chain automation company that offers a variety of services.Combined, the six packages have been downloaded more than 5000 times!In their paper, security experts from Sonatype stated that their ″analytical techniques are constantly finding and preventing counterfeit and dangerous software components before they reach current software supply chains.″

What is PyPI?

Python Package Index (also known as PyPI) is a software code repository that was established in the Python programming language.PyPI, like other software repositories like as npm, GitHub, and RubyGems, is considered to be a component of the software distribution chain.Developers can submit software packages that are used in the development of various apps and services, and it serves as a repository for these packages.

Attack Scope

The fraudulent shipments, according to Sonatype experts, were submitted by a single author with the ID ″nedog123,″ and some of them were sent as far back as April 2021, according to the company.Once installed, the packages contained instructions in the setup.py files that directed users through the process of downloading and installing cryptomining malware onto their PCs.According to the researchers, a single bad package may be used in many projects, infect the device with cryptominers or information-stealers, and other malicious code, making the remediation procedure exceedingly tough to complete successfully.

Malicious Packages Details

  • The following are examples of bogus PyPI packages: maratlib has received 2,371 downloads
  • maratlib1 has received 379 downloads
  • matplatlib-plus has received 913 downloads
  • mllearnlib has received 305 downloads
  • mplatlib has received 318 downloads
  • learninglib has received 626 downloads

In many cases, the names are misspelled by one character or are identical to other machine learning packages on PyPI, such as ″mplatlib″ instead of the actual ″matplotlib,″ which is a typo.It is possible that most people may not be affected by the infection if they utilize powerful antivirus protection.This is due to the fact that machine learning programs of this nature are typically targeted at researchers who employ pricey, high-performance Linux computers.Did you find this article to be interesting?

  1. Like our Facebook page and follow us on Twitter for the latest news.

Some official Python repos were infected with malware

  1. Home
  2. News
  3. Computing
  • (Photo courtesy of Kevin Ku / Pexels.) Cryptomining malware was detected by security experts in a half-dozen typosquatting packages in the official PyPI repository of the Python programming language, which was hosted on the Python programming language’s official website. An investigation by software supply chain automation and security vendor Sonatype revealed six malicious Python packages that took advantage of users’ spelling errors by utilizing tiny differences in the names of popular Python packages. Over 5000 downloads were obtained from the six bogus packages combined, demonstrating the vulnerability to software supply chains once more. These are the most effective endpoint security tools available
  • Here’s our pick for the finest virus cleanup software currently available on the market:
  • Visit this page to get a list of the finest firewall applications and services.

The security researcher at Sonatype, Ax Sharma, states, ″Our analysis methods are regularly finding and preventing counterfeit and dangerous software components before they reach current software supply chains.″

Supply chain attacks

According to Sharma’s investigation, the fraudulent shipments were all submitted by the same source, with some of them going back as far as April 2021.Despite the fact that this isn’t the first time malevolent individuals have managed to infiltrate PyPI with questionable packages, Sonatype believes it won’t be the last, no matter how awful it may seem.According to Ars Technica, who is reporting on the development, prior attacks on PyPI have been discovered, as has malicious malware hiding in other public repositories, such as RubyGems for the Ruby programming language and npm for the JavaScript language.The discoveries, while serious, may rapidly become offensive when considered in the context of a recent Veracode study, which found that the vast majority of developers never update third-party open source libraries after incorporating them into a codebase.

  1. Protect your gadgets with the help of these top antivirus programs.

Mayank Sharma would want everyone to believe that he is the resident Linux expert at TechRadar Pro, based on his nearly two decades of writing and reporting on the subject. Of course, he’s also interested in other aspects of computing, such as cybersecurity, cloud computing, containers, and programming.

Twelve malicious Python libraries found and removed from PyPI

A software security engineer discovered 12 Python libraries that were posted to the official Python Package Index (PyPI) and included harmful code.The libraries were discovered by a software security engineer.The 12 packages were identified in two different scans by a security engineer who goes by the name of Bertus on the internet, and they had been deleted from PyPI long before this story was published.All of the packages were assembled and operated in a manner that was comparable to one another.

  1. Their creator(s) copied the code from popular packages and renamed the library with a slightly different name to distinguish it from the original.
  2. Examples include four packages (diango, djago, dajngo, djanga), all of which were misspellings of Django, the name of a very famous Python framework that was used in the development of the packages.
  3. They injected harmful code to these freshly established but perfectly working projects, and more especially to the setup.py files, which were written by the folks behind these malicious packages.

Setup.py files contain a set of instructions that Python library installers such as ″pip″ perform automatically when downloading and setting up a new package within a Python project.Setup.py files may be found in the following locations: The purpose of this additional code was to carry out a variety of harmful activities, which changed depending on which malicious library was used.After discovering the first batch of 11 malicious packages on October 13 (see table below), Bertus detected yet another malicious package on October 21 (see table below).The first set of malicious libraries would attempt to collect data about each infected environment, obtain boot persistence, or even open a reverse shell on remote workstations.

  • The second set of malicious libraries would attempt to collect data about each infected environment, obtain boot persistence, or even open a reverse shell on remote workstations.
  • An infected user’s operating system clipboard was hijacked by the twelfth package, named ″colourama,″ which was financially motivated and searched for and replaced a Bitcoin address-like string every 500 milliseconds in an attempt to hijack Bitcoin payments/transfers made by the infected user with the attacker’s own Bitcoin address.
  • This package, like the previous one, was named after a prominent Python library, which in this case was ″colorama.″ Approximately one month before the package was taken down, the PyPI Stats service reported that 54 people had downloaded it.

The attacker’s Bitcoin address had just the equivalent of $40, with the most recent transfer having been received in April, indicating that the colorama package had failed to generate any revenue.During an email conversation with ZDNet, Bertus explained that he notified the PyPI administrators with the package name, and they promptly deleted the item.The name colourama has also been barred from being used in any future package registrations, according to the report.All 12 packages were detected by the researcher using an automated technique he developed himself that examined the PyPI repository for packages with identical names – a term known as ″typo-squatted″ packages in technical terms.Bertus claims he was inspired to create the scanner after reading a security notice issued by the Slovak National Security Office last year, which alerted Python developers about 10 dangerous Python libraries that had been published to the Python Package Index (PyPI) website.

  1. They had also utilized typo-squatted names and waited for customers to install them by mistake or carelessness for weeks before being taken down, which took many weeks.
  2. In an interview with ZDNet, Bertus explained that he is now concentrating on enhancing the Python (PyPI) scanner and that he would be performing more frequent scans.
  3. In addition, ″I’ve considered applying my findings to other repositories, such as RubyGems or JavaScript’s npm,″ he said, but ″I haven’t had the opportunity to do so yet.″ Since each programming language and repository is a little different, it will take some time to create it for another repository, says the developer.
  4. Bertus will undoubtedly be required to contribute to the npm package repository for JavaScript.
  5. A Swedish developer uncovered 38 typosquatted JavaScript libraries that had been published to the npm repository in August 2017.
  6. Local environment variables were captured by the malicious code contained in those libraries, which was then uploaded to the attacker’s server.

RELATED COVERAGE:

  • The WordPress team is focused on ″erasing previous versions of the software from existence on the web.″
  • Young women are dominating the tech industry, but they still face obstacles. CNET
  • It is now possible to get security warnings for Java and.NET projects on GitHub
  • The top ten programming languages used by developers in open source projects TechRepublic
  • A new DDoS botnet has been launched against Hadoop business servers.
  • ‘Kotlin for Android is currently the fastest-growing programming language,’ according to the article.
  • Swift, developed by Apple, is gaining popularity, whereas Python is losing ground.
  • In the next 10 weeks, about 62 percent of all Internet sites will be using an unsupported PHP version.

Leave a Reply

Your email address will not be published.