Investigating a backdoored PyPI package targeting FastAPI applications

Some thoughts:<p>1. The blast radius appears to be very minimal, the affected github package has 0 stars, 2 contributers, 1 watcher and 4 issues total.<p>2. The issue was caught and resolved quickly (within a day?).<p>3. I haven&#x27;t seen any explanation by the developer on whether there account was compromised?

The author worked in Belarus for Wargaming.net until just before making this commit. Wargaming recently withdrew their operations from Belarus and Russia for obvious reasons, and the author appears to have lost his job with them as a result. Combined with the way he nonchalantly reversed the commit and I’m thinking the theory on r&#x2F;netsec may not be so far fetched.

According to <a href="https:&#x2F;&#x2F;pypistats.org&#x2F;packages&#x2F;fastapi-toolkit" rel="nofollow">https:&#x2F;&#x2F;pypistats.org&#x2F;packages&#x2F;fastapi-toolkit</a>, this package had 158 downloads in total in the past month. This would include automated tools (e.g. this GuardDog mentioned in TFA) grabbing every single package version published.<p>But of course they have to hype it up with &quot;50k stars&quot;, &quot;used by Microsoft, Uber, and Netflix&quot; blah blah, otherwise it&#x27;s a complete non-story.

More FUD from attention seeking, for-profit organizations. Even a tiny bit of digging shows this is virtually a non-issue. Look at the gh repo, the pypi stats

&gt; a package whose maintainer&#x27;s account was likely compromised by a malicious actor<p>They don&#x27;t say why they think it was an account compromise, rather than a malicious maintainer.

Again some esoteric package that likely nobody uses. If you’re worried about such attacks, private registry mirrors can go a long way.

The issue from the researchers appears to be here: <a href="https:&#x2F;&#x2F;github.com&#x2F;timaakulich&#x2F;fastapi_toolkit&#x2F;issues&#x2F;4" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;timaakulich&#x2F;fastapi_toolkit&#x2F;issues&#x2F;4</a><p>This is definitely pretty strange. Account takeovers happen, but just reverting the commit and closing the issue after one gets discovered is not the best way to handle these.<p>This is the reality of our modern software development process though. Your threat model now must include the GitHub account of every maintainer of every open source project you use.