Популярность имеет свои минусы. Чем популярней язык программирования, тем выше его распространённость, а значит найдутся те кто поспешит воспользоваться этим.
С ростом популярности Python всё больше на PyPi появляется вредоносных пакетов. Трояны, стиллеры и доставщики более опасных вредоносов.
Команда PyPi постоянно мониторит подобные случаи но и их возможности достигли предела. В результате сервис временно закрывает возможность заливки новых пакетов и регистрации юзеров.
PyPI new user and new project registrations temporarily suspended
Возможно одной из причин большого наплыва вредоносов является резко возросшая доступность их создания. Сегодня любой, даже не программист, может попросить у ChatGPT написать необходимый код и все инструкции для атаки.
Основной тип атаки - рассчёт на опечатку в названии пакета. Если невнимательный программист случайно установит pilow или djangoo, считай что вредонос уже в системе.
Чтобы избежать подобных факапов я рекомендую:
▫️ Всегда работайте в виртуальном окружении, неизвестные проекты устанавливайте внутри контейнеров.
▫️ Используйте файл requirements.txt вместо ручной установки пакетов
▫️ Очень внимательно пишите названия пакетов, а после написания проверьте еще раз. Сверьте с названием из документации.
▫️ После успешных тестов всегда фиксируйте версию пакета. Бывали случаи когда опасный код добавляли в новые версии. К тому же и без этой опасности не рекомендуется ставить по умолчанию последнюю версию.
▫️ Используйте вспомогательные инструменты для проверки безопасности, например https://pyup.io/safety или https://github.com/PyCQA/bandit. Они помогут не только найти опасный код в чужих пакетах, но и ваш код проверит на уязвимости.
Будем надеяться что PyPi переосмыслит методы борьбы с вредоносами, например внедрит ИИ для проверки как симметричный шаг.
#offtop
Systematic expulsion of #Alawites from north Hama countryside by Sharaa government. Reallocation of #Syria land.
Excellent Report By Bashir Ghadir
1. 12 Alawite Villages near Hama, Syria have been emptied of their inhabitants.
2. HTS expelled the villagers and offered their lands to investors through a corporation connected to the governorate. The investors get 40% of the profits. The state gets 60%.
3. Alawites tried to come back to their land, but the local authorities told them they could not guaranty their safety. The Alawite farmers were informed that their lands had been appropriated by the `Iktifa' corporation.
4. The same thing is happening in the countryside of Latakia and Homs.
https://youtu.be/5BX7OgmDsmA?si=ZNJeTxDPv0hEJjqG via
@YouTube
Exactly a year ago, this is how easy it was for them to kill old men just for being #Alawites. This is the result of more than a decade of incitement against our sect mainly by Qatar and their Muslim brotherhood.
Why? Because it's too hard for their Islam to accept another faith. Until this very day, the media calls Alawites the #Assad sect whenever a massacre is being mentioned. Assad and his majority Sunni army fled or joined the new terrorist regime long ago, while civilian Alawites are still being oppressed with media cover up.
In #Jolani's textbook, you disperse peaceful protesters by bringing FUCKING TANKS.
@TheAlawiteEcho
Tens of thousands of #Alawites are protesting in the city of #Latakia and all around the Syrian coast, rejecting the Jihadist regime of #Jolani, calling for federalism.
The Alawite community has lost thousands of civilians throughout the last year, with thousands more detained. https://t.co/SV7Sb1byDR
View tweet
"Syria Al-Julani regime released kidnapped Druze kids after months of detention
The Jolani regime has released two Druze brothers, Yanal Bashar al-Haddad (15) and Qais Bashar al-Haddad (13), who had been detained at Adra Prison in #Damascus since their arrest during the attack on #Suwayda on July 15, 2025.
Its worth noting that terriost regime kidnapped and killed a lot of Druze and Alawites kids and women (see links on X post)
❗️ Note that the terrorist regime refuse to hold accountable the militants who committed massacres against the #Alawites or #Druze, and label them as “mojahdin” =jihadists, because fighting against “infidel” minorities is considered a heroic act in their eyes."
https://x.com/SyJusticeArc/status/2006461460713488503
Thousands of #Alawites take to the streets in unprecedented protests across #Syria, sparked by allegations of a shrine attack and escalating violence. Clashes, a fatality, and curfews mark the country’s most significant unrest in years.
#Syria2024#MiddleEast#SyriaProtests
"A new massacre against the #Alawites in the city of #Latakia, in the #Dattour neighborhood, al-Mazar junction.
I beg all segments of the Syrian people, especially the #Druze, #Kurds, and any remaining members of the #Sunni community who still have a little humanity left in their hearts, to take to the streets in protest to stop these massacres against the innocent. These #massacres are not from yesterday, they are happening today, and as of moments ago, they are still being carried out by Syrian members of Hay’at Tahrir al-Sham #HTS, wearing their official uniforms.
Please, save those who remain."
https://t.me/CoastSyrian24/771