I'm reaching out today to raise an important flag regarding the Python "open source" code snippets that you might come across on this forum. It has come to my attention that a concerning number of individuals, both forum members and potentially even some staff, seem to be overlooking potential security risks.(TL;DR available at the end of the the thread)
At first glance, this code may seem innocent. There's no blatant indication of any attempt to access a Discord webhook, Telegram, or any external server that might suggest your data is being sent to a attacker. However, what many of you, may have missed upon initial inspection is the libraries being installed and executed:
The hidden threat lies within the library named "pypiele."
The tricky part happens behind the scenes:
pip install pypiele
(assuming the malicious library is disguised as "pypiele"), it downloads the malicious code onto your computer. This code is saved in a location on your system,
"AppData\Local\Programs\Python\PythonVersion\lib\nameofmalware"
Now, when you run the innocent-looking main.py script that you found online, it starts importing libraries, including the malicious "pypiele." This means the harmful code gets executed alongside the legitimate code. The attacker's script could perform actions that compromise your privacy and security, like stealing your private information, logging your keystrokes, or taking unauthorized control of your system.
Here's the tricky part: The bad library can be different in is name. It might be called "pypypal" or something else each time. This makes it hard to spot. It's important that we remain vigilant, especially in the realm of open source threads.
Don't let the apparent simplicity of a code snippet blind you to the potential risks it may conceal. By exercising caution and inspecting both the code and the libraries it employs, we can collectively work to ensure a safer and more secure coding environment.
Stay informed, stay safe.
TL;DR : When you run the innocent-looking main.py script that you found online, it starts importing libraries, including the malicious "pypiele" in our exemple. Don't let the apparent simplicity of a code snippet blind you, always look up the libraries name that you find within a open source python program and make sure they are legit using pypi.org
Thonny (has a built in package search and install installer that checks pypi repo. I recommend this, good looking out.
I'm reaching out today to raise an important flag regarding the Python "open source" code snippets that you might come across on this forum. It has come to my attention that a concerning number of individuals, both forum members and potentially even some staff, seem to be overlooking potential security risks.(TL;DR available at the end of the the thread)
At first glance, this code may seem innocent. There's no blatant indication of any attempt to access a Discord webhook, Telegram, or any external server that might suggest your data is being sent to a attacker. However, what many of you, may have missed upon initial inspection is the libraries being installed and executed:
The hidden threat lies within the library named "pypiele."
The tricky part happens behind the scenes:
pip install pypiele
(assuming the malicious library is disguised as "pypiele"), it downloads the malicious code onto your computer. This code is saved in a location on your system,
"AppData\Local\Programs\Python\PythonVersion\lib\nameofmalware"
Now, when you run the innocent-looking main.py script that you found online, it starts importing libraries, including the malicious "pypiele." This means the harmful code gets executed alongside the legitimate code. The attacker's script could perform actions that compromise your privacy and security, like stealing your private information, logging your keystrokes, or taking unauthorized control of your system.
Here's the tricky part: The bad library can be different in is name. It might be called "pypypal" or something else each time. This makes it hard to spot. It's important that we remain vigilant, especially in the realm of open source threads.
Don't let the apparent simplicity of a code snippet blind you to the potential risks it may conceal. By exercising caution and inspecting both the code and the libraries it employs, we can collectively work to ensure a safer and more secure coding environment.
Stay informed, stay safe.
TL;DR : When you run the innocent-looking main.py script that you found online, it starts importing libraries, including the malicious "pypiele" in our exemple. Don't let the apparent simplicity of a code snippet blind you, always look up the libraries name that you find within a open source python program and make sure they are legit using pypi.org
I'm reaching out today to raise an important flag regarding the Python "open source" code snippets that you might come across on this forum. It has come to my attention that a concerning number of individuals, both forum members and potentially even some staff, seem to be overlooking potential security risks.(TL;DR available at the end of the the thread)
At first glance, this code may seem innocent. There's no blatant indication of any attempt to access a Discord webhook, Telegram, or any external server that might suggest your data is being sent to a attacker. However, what many of you, may have missed upon initial inspection is the libraries being installed and executed:
The hidden threat lies within the library named "pypiele."
The tricky part happens behind the scenes:
pip install pypiele
(assuming the malicious library is disguised as "pypiele"), it downloads the malicious code onto your computer. This code is saved in a location on your system,
"AppData\Local\Programs\Python\PythonVersion\lib\nameofmalware"
Now, when you run the innocent-looking main.py script that you found online, it starts importing libraries, including the malicious "pypiele." This means the harmful code gets executed alongside the legitimate code. The attacker's script could perform actions that compromise your privacy and security, like stealing your private information, logging your keystrokes, or taking unauthorized control of your system.
Here's the tricky part: The bad library can be different in is name. It might be called "pypypal" or something else each time. This makes it hard to spot. It's important that we remain vigilant, especially in the realm of open source threads.
Don't let the apparent simplicity of a code snippet blind you to the potential risks it may conceal. By exercising caution and inspecting both the code and the libraries it employs, we can collectively work to ensure a safer and more secure coding environment.
Stay informed, stay safe.
TL;DR : When you run the innocent-looking main.py script that you found online, it starts importing libraries, including the malicious "pypiele" in our exemple. Don't let the apparent simplicity of a code snippet blind you, always look up the libraries name that you find within a open source python program and make sure they are legit using pypi.org
![[Image: ffdw3.gif]](https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Fi.postimg.cc%2FTYqrdjZY%2Fffdw3.gif)
